North Korean Chollima Actors Added BeaverTail and OtterCookie to its Arsenal

North Korean Chollima Actors have expanded their toolkit by merging BeaverTail and OtterCookie into more capable infostealers aimed at credential theft and cryptocurrency targeting, according to gbhackers. A recent campaign used a trojanized Node.js application delivered via a malicious NPM package, with the infection vector relying on obfuscated JavaScript payloads.

The operators staged the attack in fake job interviews, where BeaverTail and OtterCookie variants were blended to enhance credential harvesting and screenshot capture during recruitment-themed tasks. A notable incident saw a Sri Lankan organisation compromise after a user cloned a Bitbucket repository for a cryptocurrency-enabled chess platform, whose dependencies pulled in the malicious node-nvm-ssh package from NPM.

OtterCookie has evolved through five versions since late 2024, adding a remote shell, file exfiltration, and a cryptocurrency wallet-stealing capability, while BeaverTail handles browser credentialing across multiple wallets and downloads Python-based InvisibleFerret modules from C2s. Cisco Talos researchers also uncovered a suspicious VS Code extension mirroring an onboarding tool, a finding that aligns with the group’s editor-based delivery experimentation, according to Cisco Talos.