BeaverTail Malware Delivered Through Malicious Repositories Targets Retailers

According to Oliver Smith, GitLab Threat Intelligence, BeaverTail and InvisibleFerret malware have been distributed since at least May 2025, with the operation run by North Korean actors tracked as Contagious Interview and Famous Chollima. The campaign uses ClickFix lures to target marketing and trader roles within cryptocurrency and retail organisations rather than traditional software developers, delivering malware as compiled executables for macOS, Windows and Linux.

Infections typically download a second-stage Python stealer and a RAT dubbed InvisibleFerret, with Linux targets receiving a JavaScript BeaverTail via a shell script that installs nvm and runs node.

The campaign’s infection chain features a fraudulent hiring platform hosted at businesshire[.]top, impersonating web3 organisations recruiting cryptocurrency traders and a US-based e‑commerce retailer, prompting victims to submit details and record a video, then presenting fake camera errors and OS-specific troubleshooting commands.

Hard-coded allowlists of IPs, including 188.43.33[.]250, are used to protect operators, and the fake site logs IP and geolocation while probing for cryptocurrency wallet objects before exfiltration. The Windows build can extract Python dependencies from a password-protected 7z archive, and the campaign has reduced its target set to eight browser extensions.