Loading malware…
InvisibleFerret is a Python-based backdoor used in the North Korean-linked Contagious Interview campaign, associated with operators tracked as Famous Chollima, UNC5342, and WaterPlum. It provides remote access to compromised systems, including remote-shell functionality, and supports continued access and sensitive-data exfiltration. It operates within infection chains targeting Windows, macOS, and Linux systems.
InvisibleFerret is commonly deployed as a second-stage payload by BeaverTail, a JavaScript information stealer and downloader concealed in seemingly legitimate developer projects and malicious npm packages. Operators impersonate recruiters or employers and persuade software developers to execute malicious coding assessments, technical-interview projects, or purported troubleshooting files. BeaverTail subsequently downloads and executes InvisibleFerret, obtaining a portable Python runtime on Windows when necessary.
The campaign targets developers and IT professionals worldwide, particularly cryptocurrency, blockchain, and Web3 specialists. Compromised developer workstations provide access to sensitive personal and development information and can create opportunities for follow-on intrusion into employers or clients. InvisibleFerret supplies backdoor access within this broader credential- and cryptocurrency-theft operation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
“利用 Windows 系统的零日漏洞 CVE-2024-38193……攻击者瞬间获得 SYSTEM 权限,部署 InvisibleFerret 后门。”
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lazarus then leverages zero-day vulnerabilities and sophisticated tools, such as the InvisibleFerret backdoor, to achieve deeper system access and exfiltrate sensitive data, including cryptocurrency from digital wallets.
InvisibleFerret Python-based backdoor used to access compromised systems
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
332 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
171 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family distributed by the North Korean-linked WaterPlum campaign through fraudulent technical interviews and developer-task lures.
A named malicious payload delivered through trojanized NPM packages in WaterPlum's fake-job-interview campaign. The campaign used remote-access trojans and infostealers to steal browser credentials, keystrokes, screenshots, wallet private keys, seed phrases, and identity documents.
A malware family delivered through fake job-interview downloads by WaterPlum. The campaign's malware enables theft of authentication data, cryptocurrency-wallet material, files, clipboard contents, keystrokes, and screenshots, as well as follow-on access.
The post links to Atlassian's "Disrupting Contagious Interview" publication and tags #InvisibleFerret alongside other malware names.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.