Malware / Outils # OTTERCOOKIE (stealer) BEAVERTAIL (loader) Socket.IO RAT (rat)
BeaverTail
BeaverTail is a JavaScript malware family associated with the DPRK-linked Contagious Interview activity cluster and related Lazarus-linked developer-targeting campaigns.
Profile source: Mallory opens in a new tabBeaverTail
Family profile
BeaverTail is a JavaScript malware family associated with the DPRK-linked Contagious Interview activity cluster and related Lazarus-linked developer-targeting campaigns. It is commonly used as an early-stage payload in social-engineering and software supply-chain operations aimed at software developers, especially those working in cryptocurrency, Web3, blockchain, and other high-value technical environments. BeaverTail has been delivered through fake job interviews and coding challenges, trojanized repositories, malicious npm packages, compromised GitHub projects, VS Code task abuse, and counterfeit developer applications built with cross-platform frameworks.
BeaverTail primarily functions as an infostealer and loader. Its theft capabilities include collection of browser-stored credentials, autofill data, browser profile information, cryptocurrency wallet extension data, and other sensitive files such as cloud credentials, SSH material, shell histories, environment files, and development-related secrets. Multiple reports also describe host profiling and system-information collection. In several observed chains, BeaverTail exfiltrates stolen data and then retrieves additional malware, most notably the Python-based InvisibleFerret backdoor; some campaigns instead branch to OTTERCOOKIE or use BeaverTail as part of a broader multi-stage toolkit.
The malware has been observed in cross-platform JavaScript execution chains affecting Windows, macOS, and Linux. Variants and adjacent delivery chains have used obfuscation, anti-tamper logic, steganographic payload hiding in repository assets, blockchain-based dead-drop resolution, and developer-tooling triggers such as automatic execution when a repository is opened or a local development server is started. Some BeaverTail-associated components also provide backdoor-style functionality, including command execution, file search and upload, and download-and-execute behavior, but BeaverTail is most consistently characterized as the initial stealer/loader stage preceding more persistent or feature-rich implants.
Operationally, BeaverTail is closely tied to campaigns in which threat actors impersonate recruiters or collaborators and lure victims into running malicious code during interviews, freelance engagements, or package installation. The malware’s repeated focus on browser sessions, wallet data, source code, tokens, and developer secrets makes it particularly dangerous on engineering workstations and build environments, where compromise can enable both direct financial theft and downstream supply-chain intrusion.
Capabilities
- Credential Theft
- Exfiltration
- Initial Access
- Post Exploitation
- Reconnaissance
Reported operators
Threat actors
9 named in public reportingThe PolinRider threat group was first detected this year when cybersecurity analysts identified hundreds of GitHub repositories with hidden JavaScript code that downloads an updated version of the BeaverTail malware.
This will eventually to either Ottercookie / Beavertail malware. Running the entire repository ultimately leads to an infection.
Instructional videos have also been found with what it looks like non-native English text, detailing how to set up a Beavertail malware command-and-control server and how to crack cryptocurrency wallet passwords.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
The code in index.js implements the Node.js fetch API to send an HTTP request to that URL and retrieve BeaverTail malware.
"Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure... DPRK’s BeaverTail malware"
MITRE ATT&CK
BeaverTail in ATT&CK
98 distinct techniquesTechniques
98 techniques T1656 Impersonation T1204.002 Malicious File T1555 Credentials from Password Stores T1195 Supply Chain Compromise T1566.003 Spearphishing via Service T1105 Ingress Tool Transfer T1204 User Execution T1059.007 JavaScript T1027.003 Steganography T1566 Phishing T1036.005 Match Legitimate Resource Name or Location T1102 Web Service T1027 Obfuscated Files or Information T1036 Masquerading T1140 Deobfuscate/Decode Files or Information T1102.001 Dead Drop Resolver T1053 Scheduled Task/Job T1082 System Information Discovery T1057 Process Discovery T1195.001 Compromise Software Dependencies and Development Tools T1571 Non-Standard Port T1071.001 Web Protocols T1059 Command and Scripting Interpreter T1041 Exfiltration Over C2 Channel T1071.002 File Transfer Protocols T1199 Trusted Relationship T1083 File and Directory Discovery T1555.003 Credentials from Web Browsers T1518 Software Discovery T1649 Steal or Forge Authentication Certificates T1195.002 Compromise Software Supply Chain T1620 Reflective Code Loading T1564.003 Hidden Window T1573 Encrypted Channel T1505 Server Software Component T1070 Indicator Removal T1574 Hijack Execution Flow T1189 Drive-by Compromise T1566.002 Spearphishing Link T1583.001 Domains T1071 Application Layer Protocol T1059.006 Python T1555.001 Keychain T1119 Automated Collection T1657 Financial Theft T1564.001 Hidden Files and Directories T1124 System Time Discovery T1552.001 Credentials In Files T1005 Data from Local System T1127 Trusted Developer Utilities Proxy Execution T1027.007 Dynamic API Resolution T1176 Software Extensions T1070.004 File Deletion T1074 Data Staged T1608.001 Upload Malware T1027.013 Encrypted/Encoded File T1546.016 Installer Packages T1217 Browser Information Discovery T1552 Unsecured Credentials T1564 Hide Artifacts T1546 Event Triggered Execution T1059.004 Unix Shell T1059.003 Windows Command Shell T1497.001 System Checks T1056.001 Keylogging T1048 Exfiltration Over Alternative Protocol T1539 Steal Web Session Cookie T1090.002 External Proxy T1586 Compromise Accounts T1587.001 Malware T1585 Establish Accounts T1497 Virtualization/Sandbox Evasion T1547.009 Shortcut Modification T1059.005 Visual Basic T1560 Archive Collected Data T1547.001 Registry Run Keys / Startup Folder T1598 Phishing for Information T1588.001 Malware T1568 Dynamic Resolution T1078 Valid Accounts T1203 Exploitation for Client Execution T1204.001 Malicious Link T1589 Gather Victim Identity Information T1566.001 Spearphishing Attachment T1219 Remote Access Tools T1120 Peripheral Device Discovery T1218 System Binary Proxy Execution T1053.005 Scheduled Task T1055 Process Injection T1547 Boot or Logon Autostart Execution T1560.001 Archive via Utility T1001.001 Junk Data T1074.001 Local Data Staging T1654 Log Enumeration T1567 Exfiltration Over Web Service T1059.001 PowerShell T1554 Compromise Host Software Binary T1552.004 Private Keys
Reporting
Research mentioning BeaverTail
Jul 24
Security Online Info
Contagious Interview Hides Malware in Coding Tests
Elastic Security Labs reported a Contagious Interview intrusion tied to a DPRK-aligned threat cluster after suspicious activity targeted Elastic’s community Slack workspace. Using a fake recruiter persona named Maxwell, the operator posted a fraudulent job opportunity and coding challenge that directed victims to trojanized Next.js e-commerce repositories. The malicious code hid payload components inside SVG image files using steganography, embedding Base64 fragments in flag images that were reassembled by serverValidation.js and executed with eval() when the local development server started. The campaign matches the broader Contagious Interview tradecraft tracked in MITRE ATT&CK as G1052, which relies on fake hiring outreach, code-repository lures, and social engineering to infect developers across Windows, macOS, and Linux. Elastic said the infection chain deployed a browser credential and crypto-wallet stealer, a file stealer, a persistent Socket.IO RAT, and a clipboard stealer capable of fetching Windows PE payloads, while code similarities to OTTERCOOKIE and infrastructure overlaps previously documented by JFrog reinforced the attribution. MITRE also associates the cluster with malware such as BeaverTail and InvisibleFerret, along with credential theft, financial theft, persistence through platform-specific startup mechanisms, and exfiltration over C2 and cloud or messaging services.
Jul 20
Cyber Security News
North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers
Jul 20
Gurucul Threat Research
New North Korean Campaign Uses Fake Coding Interviews to Steal Developer Credentials | Community Portal | Gurucul
Jul 18
Cyberveille
Campagne Contagious Interview : malware DPRK caché dans des SVG via stéganographie | CyberVeille
Jul 15
Gurucul Threat Research
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist | Community Portal | Gurucul
Attackers compromised the Artlist WordPress subdomain new-blog.artlist[.]io and used it to deliver a sophisticated ClickFix malware campaign that presented visitors with a fake CAPTCHA and tricked them into running PowerShell. The injected JavaScript used an EtherHiding technique, querying a Polygon smart contract to dynamically retrieve the next-stage host auth-code-check[.]info, then downloaded a multi-stage infection chain from the attacker-controlled backend. Researchers traced the intrusion to WordPress credentials stolen from an Israeli freelance developer whose machine had been infected by an infostealer after downloading a pirated copy of Adobe Acrobat Pro DC in 2023. The payload chain reportedly used a password-protected archive, a signed StruSoft/FEM-Design updater, and DLL side-loading to decode shellcode and load a final native RAT that supported encrypted and Tor-backed C2, browser credential theft, keylogging, clipboard and screen access, hidden desktop interaction, file transfer, shell and process control, SOCKS proxying, service installation, and in-memory PE delivery.
Jul 14
Trojan Killer News
Artlist ClickFix Page Dropped a Native Windows RAT
Jul 14
Infostealers Com Infostealers
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist | InfoStealers
Jul 14
Malware News
