Loading malware…
OtterCookie is a JavaScript-based remote-access trojan and information stealer associated with the North Korea-linked Contagious Interview campaign and operators tracked as WaterPlum. It combines remote command execution on compromised hosts with system profiling, Chrome extension-data collection, clipboard monitoring, and keylogging. Its information-stealing functionality targets browser credentials and cryptocurrency-related data, while remote-access capabilities allow operators to control compromised systems and conduct further malicious activity.
OtterCookie is distributed through malicious npm packages and developer projects presented as recruitment assessments or technical-interview materials. Operators impersonate recruiters and prospective employers, approaching software developers, freelance IT professionals, and cryptocurrency, blockchain, and Web3 specialists through social networks, job boards, and freelance marketplaces. Victims are induced to execute malicious code under the pretext of completing coding assignments or resolving purported interview-software problems. This delivery model exploits developers’ routine use of third-party packages and unfamiliar code repositories.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OtterCookie JavaScript remote-access and information-stealing malware
"DPRK's Contagious Interview campaign is still running" published by Moonlock. #macOS, #ContagiousInterview, #OtterCookie
Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based remote access trojan (RAT), and a clipboard stealer.
The campaign used the JavaScript infostealer BeaverTail, the cross-platform Python backdoor InvisibleFerret, and most recently OtterCookie, a new backdoor identified in December 2024.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
The campaign targeted Web3 and decentralised finance (DeFi) developers globally via AI-generated fake job offers delivered through LinkedIn, using three interoperating malware families BeaverTail, OtterCookie, and InvisibleFerret in a phased infection chain that begins with a malicious coding assessment and culminates in full credential exfiltration and wallet drainage.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
WaterPlum actors upload malicious Node Package Manager (NPM) packages embedded with either BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle malware.
“Other sensitive data targeted for exfiltration includes… Clipboard information, key-logs (recorded keystrokes), screenshots.”
“Once a target is compromised, the attackers attempt to steal ... cryptocurrency private keys and seed phrases...”
The attackers obtained funds or account credentials from more than 7,000 cryptocurrency wallets... Stolen browser logins, wallet keys... can support further theft.
Targeted data includes “Any files or data of interest to the actors on a PC or in shared folders (ID pictures of driver’s licenses, passports, etc.).”
“Other sensitive data targeted for exfiltration includes… Clipboard information, key-logs (recorded keystrokes), screenshots.”
205 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
137 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named malicious payload delivered through trojanized NPM packages in WaterPlum's fake-job-interview campaign. The content links the campaign to theft of browser credentials, cryptocurrency-wallet private keys and seed phrases, screenshots, keystrokes, and identity documents, without individually attributing each function to OtterCookie.
A malware family used in WaterPlum's fake-interview delivery chain against developers and Web3 personnel. It is part of a payload set used for credential and wallet theft and to facilitate deeper access to compromised systems.
The post links to Atlassian's "Disrupting Contagious Interview" publication and tags #OtterCookie alongside other malware names.
A malware family used in Contagious Interview compromises of developers and cryptocurrency/Web3 specialists.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.