Loading malware…
OtterCookie is a JavaScript-based remote-access trojan and information stealer associated with North Korean-linked WaterPlum operators and the Contagious Interview campaign. It combines remote command execution with information collection, including system profiling, Chrome extension-data collection, clipboard monitoring, and keylogging. Its information-stealing functionality targets browser credentials and cryptocurrency-related data, while its remote-access component allows operators to execute commands on compromised hosts.
OtterCookie is distributed through malicious npm packages and developer projects presented as legitimate technical assessments during fraudulent recruitment processes. Operators impersonate recruiters and employers, approaching software developers, freelance IT professionals, and cryptocurrency, blockchain, and Web3 specialists through social networks, job boards, and freelance marketplaces. Victims are persuaded to download and execute malicious code during purported interviews or coding assignments. Compromised developer systems can expose sensitive personal and work-related information and provide opportunities for follow-on intrusion into employers or clients.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OtterCookie JavaScript remote-access and information-stealing malware
"DPRK's Contagious Interview campaign is still running" published by Moonlock. #macOS, #ContagiousInterview, #OtterCookie
Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based remote access trojan (RAT), and a clipboard stealer.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
WaterPlum actors upload malicious Node Package Manager (NPM) packages embedded with either BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle malware.
“Other sensitive data targeted for exfiltration includes… Clipboard information, key-logs (recorded keystrokes), screenshots.”
“Once a target is compromised, the attackers attempt to steal ... cryptocurrency private keys and seed phrases...”
The attackers obtained funds or account credentials from more than 7,000 cryptocurrency wallets... Stolen browser logins, wallet keys... can support further theft.
Targeted data includes “Any files or data of interest to the actors on a PC or in shared folders (ID pictures of driver’s licenses, passports, etc.).”
“Other sensitive data targeted for exfiltration includes… Clipboard information, key-logs (recorded keystrokes), screenshots.”
205 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
138 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as malware associated with a North Korean campaign using fake coding interviews to steal developer credentials. The post does not describe its individual capabilities.
A named malicious payload delivered through trojanized NPM packages in WaterPlum's fake-job-interview campaign. The content links the campaign to theft of browser credentials, cryptocurrency-wallet private keys and seed phrases, screenshots, keystrokes, and identity documents, without individually attributing each function to OtterCookie.
A malware family used in WaterPlum's fake-interview delivery chain against developers and Web3 personnel. It is part of a payload set used for credential and wallet theft and to facilitate deeper access to compromised systems.
The post links to Atlassian's "Disrupting Contagious Interview" publication and tags #OtterCookie alongside other malware names.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.