GhostHire is a 2025 BlueNoroff campaign within the broader SnatchCrypto operation that targets Web3 and blockchain developers with fraudulent recruitment exercises. After an initial screening, a supposed recruiter moves the victim to a Telegram bot and imposes a short deadline to download and run a ZIP archive or GitHub repository containing a malicious project. The cross-platform infection chain steals developer and user data, including credentials, secrets, browser information, and profile media, and shares infrastructure with the related GhostCall campaign. BlueNoroff is primarily financially motivated and is also tracked under several Lazarus-associated names.