Team 8

Team 8 is a North Korea-linked threat actor associated with the Contagious Interview campaign. According to the provided content, the group is spreading the StoatWaffle malware family through malicious Microsoft Visual Studio Code projects, using blockchain-themed repositories as lures. The campaign abuses VS Code's tasks.json auto-run behavior so that malicious code executes when a victim opens and trusts a repository. The infection chain is multi-stage: an initial task downloads payloads from Vercel and runs them via cmd.exe, installs Node.js if needed, and fetches additional files for cross-platform execution. StoatWaffle is described as modular malware implemented in Node.js, including a loader that communicates with command-and-control infrastructure, a second downloader, an information-stealing module, and a remote access trojan module. The stealer collects browser credentials, designated browser extension data, installed software details, macOS Keychain data, and can access Windows data through WSL environments. The RAT module enables remote command execution and returns results to the operators. The content states that Team 8 previously relied mainly on OtterCookie in the Contagious Interview campaign before adopting StoatWaffle around December 2025. The only alias directly supported by the content is team_8.