Cisco Talos identified PylangGhost, a Python-based Windows RAT used exclusively by the North Korean-aligned Famous Chollima actor, also known as Wagemole. The campaign targets workers with cryptocurrency and blockchain experience through fake recruiter workflows and skill-testing sites impersonating companies such as Coinbase, Robinhood, Uniswap, Archblock, and Parallel Studios. Victims are instructed to copy and run ClickFix-style commands that download a ZIP archive, unpack a Python library, and launch the RAT through a renamed Python interpreter. PylangGhost creates logon persistence through the Windows registry, fingerprints the host, communicates with C2 over RC4-encrypted HTTP, and supports file transfer, OS shell access, sleep/exit commands, and theft of browser cookies and credentials from password-manager and cryptocurrency-wallet extensions.