Fake recruitment sites with a referral-code gate that hand job applicants a ClickFix command installing the OverLord stealer

This search is a tracking aid keyed on the operation's servers, payload hosts, the control-panel title and the payload hashes; the lure pages themselves change name with every brand. Lure servers: 208.84.100[.]64, 65.110.40[.]18 and 170.205.28[.]251, earlier 23.137.104[.]77 and 193.160.32[.]10. Command-and-control: api.cerysoi[.]ink and api.chestsoi[.]ink on 207.241.172[.]222, whose login page is an OverLord panel titled "Subtensor — Sign In". Payload store: api.gamsterb[.]ink with fallback api.fallgamsterb[.]ink. Example lure hosts as of 2026-11-08: surgebuilders[.]ink, ambercouncil[.]xyz, inv2bullish[.]xyz, workwitheigen[.]xyz, joinmotus[.]site, scrolltalents[.]online, movementgigs[.]site, geoveral[.]ink, mantle2council[.]xyz, inv2taiko[.]xyz, celestiatalents[.]xyz, joinwebflow[.]xyz and mercortalents[.]xyz. Stage files, the same on every site: check.cmd / v.cmd 249626244f23928c75e6c382da62278ed1d4e012a0c0f62beafefc1e4d7c5baa, verify_m / check_m cd20f43f985f7df7ba3ad9b08e5bdbecc20aaa4d8f60dc09e8468bdd1b249fe6, install_guard.js 223fb04f69707d6ca7c22759aded44e22b248bd776914a7920f35850154537ec. OverLord agent builds served as google-update-support-darwin-arm64 187a5535d4c91fd52d5a9a0285efe91fb0e70c007e619d55bb13a530a123a4f5, -darwin-amd64 3084e392a581009bef973faa15ad4f8cb36a1aa248c447944b38616044aea04d and -linux-amd64 8819a25e84f36878be2c2dc86c2a052ce6a645f01d389f4ee5d31829fae9494f. Public reporting links this activity to North Korea-nexus fake job-interview operations.