Loading malware…
OtterCookie is a JavaScript-based malware family used in the DPRK-linked Contagious Interview campaign, a long-running social-engineering operation that targets software developers through fake recruiter outreach, trojanized coding challenges, malicious repositories, and poisoned software packages. It has been associated with threat clusters tracked as Lazarus Group, WaterPlum, Famous Chollima, and REF9403, and has been observed alongside BeaverTail and InvisibleFerret in multi-stage intrusion chains.
OtterCookie evolved from an early file-grabber into a modular stealer and backdoor platform. Reported capabilities include theft of browser credentials and autofill data, collection of cryptocurrency wallet data from browser extensions, theft of sensitive files such as keys, configuration material, source code, and cloud or developer secrets, clipboard monitoring and theft, host profiling, and interactive command execution through a Socket.IO-based remote-access component. Later variants added Windows support, hardcoded file-exfiltration logic, virtual-environment checks, clipboard theft implemented with native platform commands, and dedicated stealer modules targeting Google Chrome, Brave, MetaMask, and macOS credential stores. Some variants also download and execute additional Windows payloads.
Delivery has been observed through multiple developer-focused mechanisms. These include fake interview projects that execute malware when a local development server starts, malicious Visual Studio Code workspace task configurations that trigger on folder open, npm package compromise and trojanized dependencies with post-install execution, and repositories that conceal payload fragments inside benign-looking assets such as SVG flag images or fake font files. Operators have also used increasingly layered obfuscation and guarded payload delivery, including split URLs, runtime concatenation, token-gated responses, integrity checks, and error-path execution to evade static analysis and signature-based detection.
OtterCookie targets developer workstations across Windows, macOS, and Linux, with particular emphasis on environments likely to contain browser sessions, source repositories, cloud credentials, SSH material, and cryptocurrency wallets. Victimology reported around the campaign includes software developers, Web3 and cryptocurrency personnel, financial institutions, FinTech companies, and cryptocurrency operators. The malware’s role in compromising developer endpoints creates downstream supply-chain risk when infected users publish or redistribute trojanized code.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"DPRK's Contagious Interview campaign is still running" published by Moonlock. #macOS, #ContagiousInterview, #OtterCookie
We named it "OtterCookie" and published a blog article in December 2024... In OtterCookie v4, which has been observed since April 2025, two new Stealer modules have been added, and some new features have been added to the Main module.
Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based remote access trojan (RAT), and a clipboard stealer.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
On 4 September 2025, npm user pavlo123123 (pavlovainerman[@]gmail.com) uploaded some-promise, a package that derives code from the legitimate any-promise package. some-promise comes loaded with a malicious postinstall script...
A helper script rebuilds the code and runs it at server start... Watch Node processes that spawn shells or PowerShell.
After the request, the flow code captures the request’s response, stores it in the token object, and executes the content using the eval() function.
the developers took care to split the entire URL into several parts within the code.
Attackers split the payload into Base64 chunks. Then they tucked those chunks inside SVG country-flag files. A helper script rebuilds the code and runs it at server start.
developers should review server startup files and asset directories, and look closely for dynamic code execution such as eval() or code that reads image files.
The recovered toolkit has four main parts: a browser credential and cryptocurrency-wallet stealer, a file stealer, a clipboard collector, and a remote-access component using Socket.IO.
The Stealer module run at first steals passwords and usernames stored in Google Chrome.
The Stealer module run at first steals passwords and usernames stored in Google Chrome.
the group’s developers created and implemented a code snippet that performs a POST request to an external address named fashdefi[.]store using port 6168.
162 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
111 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
the coding challenge is laced with malware and will trigger something nasty like InvisibleFerret, BeaverTail, OtterCookie, or one of the many other malware strains from our friends in boring Korea.
OtterCookie is referenced as malware associated with the DPRK-linked Contagious Interview campaign, with the post specifically tagging macOS and OtterCookie.
Mentioned only in related content as malware hidden in SVG images to backdoor developers.
A multi-component malware package delivered via trojanized coding-test repositories in the Contagious Interview campaign. It steals browser credentials, crypto wallet data, developer files such as keys/configs/source code, includes a Socket.IO backdoor for live shell access, and monitors the clipboard for copied secrets across Windows, macOS, and Linux.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.