North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware

According to Cisco Talos, a North Korean threat actor linked to the Contagious Interview campaign has merged some functions of BeaverTail and OtterCookie, indicating ongoing refinement of its toolset. The new evidence shows OtterCookie has gained a keylogging and screenshotting module and now blurs the line between the two malware families, with BeaverTail continuing to act as an information stealer and downloader.

The activity is attributed to a threat cluster tracked as CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342 and Void Dokkaebi. Gates of insight were widened when Google Threat Intelligence Group (GTIG) and Mandiant revealed the actor’s use of EtherHiding to fetch next-stage payloads from blockchain networks, turning decentralised infrastructure into a resilient C2 server.

Contagious Interview refers to a recruitment scam dating back to late 2022, where impersonated hiring organisations led job seekers to install malware as part of a supposed technical assessment. Be aware that BeaverTail, OtterCookie and the newer OtterCookie v5 are reported to include functions such as browser and wallet data exfiltration, remote access capabilities and a VLC of modular components.