North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft

A Cisco Talos report links North Korea’s Famous Chollima APT with the Lazarus-aligned threat actor to a campaign that uses fake job offers and trojanized open‑source tools to infect developers with BeaverTail and OtterCookie, a cross‑platform malware suite now capable of keylogging, clipboard theft, and cryptocurrency wallet theft.

The infection chain begins with a fake job offer shared via freelancing platforms such as Fiverr or Discord messages, directing victims to download a Node.js project called “Chessfi” that is trojanised. Once cloned from Bitbucket, the application’s package.json executes a malicious dependency named “node-nvm-ssh” from the NPM repository, which contains postinstall scripts that load an obfuscated payload.

The latest OtterCookie variant (v5) includes a keylogging module and screenshot function, with data exfiltrated to a C2 server at 172.86.88[.]188:1478/upload, and other modules exfiltrating files to 172.86.88[.]188:1476/upload. A malicious VS Code extension masquerades as “Mercer Onboarding Helper” to load OtterCookie code, while the operation also targets cryptocurrency wallets and browser data, demonstrating an expansive toolset designed for data and financial theft.