Loading malware…
BeaverTail is a JavaScript-based information stealer and downloader used in the North Korea-linked Contagious Interview campaign, associated with operators tracked as Famous Chollima, UNC5342, and WaterPlum. It targets Windows, macOS, and Linux systems, particularly those belonging to software developers and cryptocurrency, blockchain, and Web3 professionals. Attackers impersonate recruiters and employers, persuading candidates to execute apparently legitimate coding assessments containing malicious Node.js code. BeaverTail is distributed through malicious npm packages and developer projects hosted on public code-repository platforms.
BeaverTail collects browser credentials and cryptocurrency-wallet extension data, including data associated with MetaMask, Coinbase Wallet, Phantom, and other wallets. It targets multiple browser profiles across Chrome, Brave, and Opera, with additional collection from Edge on Windows. Platform-specific collection includes macOS login keychains, Linux keyrings, and Firefox credential-related data. It also collects Solana wallet key material. The malware gathers basic host information to identify infected systems and guide collection, then exfiltrates stolen files through HTTP POST requests. An analyzed implementation repeats collection five additional times at ten-minute intervals.
The malware conceals its JavaScript through obfuscation, encoded strings, and placement within otherwise plausible application code, sometimes after extensive whitespace. After collecting data, BeaverTail downloads and executes the Python-based InvisibleFerret backdoor. On Windows, it can obtain a portable Python runtime if the required interpreter is absent. This combination of information theft and secondary-payload execution supports cryptocurrency theft and further compromise of developer workstations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This document delves into the intricacies of the "BeaverTail" dropper, the Node.js component, responsible for downloading and executing a secondary Python-based payload (named “InvisibleFerret”) after stealing sensitive data from the victim’s computer.
BeaverTail JavaScript-based malware delivered through malicious packages and developer projects
The PolinRider threat group was first detected this year when cybersecurity analysts identified hundreds of GitHub repositories with hidden JavaScript code that downloads an updated version of the BeaverTail malware.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
BeaverTail malware begins by executing its “main” function, gathering system information to determine if the system runs Windows, macOS, or Linux.
416 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as malware associated with a North Korean campaign using fake coding interviews to steal developer credentials. The post does not describe its individual capabilities.
A malware family distributed by the North Korean-linked WaterPlum campaign through fraudulent technical interviews and developer-task lures.
A named malicious payload delivered through trojanized NPM packages in WaterPlum's fake-job-interview campaign. The content attributes credential, cryptocurrency-wallet, and other data theft to the campaign, but does not separately specify BeaverTail's individual capabilities.
A malware family delivered through fake technical-interview downloads in the WaterPlum/Contagious Interview campaign. The payload set steals browser and cryptocurrency-wallet credentials and other sensitive data, and can support follow-on access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.