Loading story…
WaterPlum, a North Korea-linked threat group, has introduced a new modular malware family called StoatWaffle in its Contagious Interview campaign, replacing the previously used OtterCookie for activity attributed to Team 8 (also tracked as Moralis or Modilus). The malware is being delivered through malicious blockchain-themed repositories that abuse VSCode workspace trust and .vscode/tasks.json with runOn: folderOpen, causing code to execute when a victim opens and trusts the project. The initial task downloads payloads from a Vercel-hosted web application, launches cmd.exe, retrieves vscode-bootstrap.cmd, checks for Node.js, installs it if absent, and then runs env.npl and package.json to begin the staged infection chain.
NTT Security’s analysis describes StoatWaffle as a Node.js-based, multi-stage framework composed of a loader, a stealer, and a RAT component. The first-stage loader polls the C2 endpoint /api/errorMessage every five seconds and executes returned Node.js code, while a second-stage downloader contacts /api/handleErrors to fetch additional code and deploy follow-on modules. The stealer targets browser-stored credentials and extension data from Chromium-based browsers and Firefox, and on macOS also targets Keychain data, staging stolen files in randomly named temporary directories before uploading them to /upload. Reference 0 is a secondary report summarizing NTT’s findings, while References 1 and 2 are the original Japanese and English NTT writeups describing the same malware, delivery chain, and victim data theft behavior.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft introduced protections in Visual Studio Code versions 1.109 and 1.110 to mitigate abuse of tasks.json auto-run behavior, disabling automatic tasks by default and warning users about auto-run tasks in newly opened workspaces. The changes were reported in connection with WaterPlum's use of malicious VS Code projects to deliver StoatWaffle.
NTT Security Japan published analysis of StoatWaffle, describing its multi-stage loader, stealer, and RAT modules, along with data theft targets including browser credentials, browser extension data, installed software information, macOS Keychain data, and Windows-side data accessible from WSL environments.
In the StoatWaffle attack chain, WaterPlum distributed blockchain-themed malicious Visual Studio Code repositories that abused .vscode/tasks.json with the runOn: folderOpen setting to execute code when victims opened and trusted the project. The chain then downloaded staged payloads from a Vercel-hosted application and contacted command-and-control infrastructure to fetch additional Node.js code.
Around December 2025, WaterPlum's Team 8 cluster in the Contagious Interview campaign began replacing its previously used OtterCookie malware with a newly identified modular Node.js malware family called StoatWaffle.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourceinfoworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcejp.security.ntt
Open sourcejp.security.ntt
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Microsoft and Enki White Hat reported ongoing “Contagious Interview” activity** in which threat actors impersonate recruiters and run realistic developer interview workflows to trick targets into executing malicious code. The campaign targets software developers (including at enterprise solution providers and media/communications firms) and has been active since at least December 2022, using lures such as coding assignments and repositories hosted on common platforms (e.g., GitHub, GitLab, Bitbucket). Recent intrusions show an adaptation to *Visual Studio Code* workflows: victims are prompted to trust the repository, and once trust is granted, VS Code can automatically execute attacker-supplied task configurations, turning a routine “open the project” step into an initial execution vector. Technical analysis describes GitHub-hosted repositories containing a malicious `.vscode/tasks.json` where `runOptions.runOn` is set to `folderOpen`, causing hidden, whitespace-obfuscated commands to run when the folder is opened in VS Code. The tasks execute OS-specific downloaders that fetch and run follow-on scripts from C2 infrastructure; on Linux/macOS, a script is downloaded to `$HOME/Documents/tokenlinux.npl`, renamed to `tokenlinux.sh`, and executed, while Windows attempts to download to `%USERPROFILE%/parse` and rename to `token.cmd` (the Windows payload was unavailable during analysis due to an “Access permanently suspended.” response). The Linux/macOS chain includes a downloader assessed to be LLM-generated (noted for unusually detailed comments and emoji usage), which stages a local Node.js runtime, pulls additional files such as `parser.js` and `package.json`, and executes the obfuscated JavaScript downloader; observed payload sets include **BeaverTail** and **InvisibleFerret**, with **OtterCookie** also deployed in some paths depending on environment or attack stage.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Aug 3, 2026