ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware

A North Korean-linked group, WaterPlum’s Cluster B, has evolved its tactics by introducing OtterCandy—a Node.js–based RAT and information stealer—through the ClickFake Interview campaign, with significant enhancements observed in August 2025. The threat actor, attributed to North Korea, orchestrated two primary campaigns: Contagious Interview and ClickFake Interview, with Cluster B often referred to as the BlockNovas cluster for its bespoke tools.

OtterCandy is deployed across Windows, macOS and Linux, and is crafted in Node.js using the Socket[.]IO library for real-time C2 communications; a sample matching its signature was first identified on VirusTotal in February 2025. In this August 2025 update, OtterCandy moved from v1 to v2, adding a client_id, expanding browser-extension data exfiltration from four to seven IDs, and enhancing cleanup routines, including the new ss_del command to purge forensic traces.

The campaign leverages a tailored ClickFix webpage disguised as an interview platform to coax downloads, with DiggingBeaver continuing to provide persistence alongside OtterCandy and a self-resurrect mechanism for relaunching after events. Continuous threat intelligence and proactive monitoring of Node.js activity and Socket[.]IO traffic are urged to help defenders respond to this evolving threat.