North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks

Researchers at Cisco Talos have uncovered a sophisticated campaign by the Famous Chollima subgroup of Lazarus, in which attackers deploy blended JavaScript tools—BeaverTail and OtterCookie—to conduct keylogging, screenshot capture and data exfiltration. The activity, part of the broader “Contagious Interview” operation, has evolved to include new modules for credential theft and surveillance.

In one incident, Talos observed an infection at a Sri Lankan organisation after a user accepted a fake job offer, where a trojanised Node.js project named ChessFi delivered a malicious package, node-nvm-ssh, via postinstall scripts.

The OtterCookie module can log keystrokes and take periodic screenshots, with data uploaded to the OtterCookie C2 server at TCP port 1478 through an /upload endpoint, and with a remote shell and file-upload capabilities over socket[.]io-client on port 1418 and other features such as a hidden cryptocurrency extension stealer.

The campaign highlights how BeaverTail’s browser-extension and Python downloader functions merge with OtterCookie’s JavaScript modules, enabling stealthy surveillance without a full Python runtime on Windows hosts. 16 October 2025.