OtterCookie Malware

North Korean cyber actors linked to the Contagious Interview campaign have introduced a new JavaScript-based threat named OtterCookie. This campaign, also known as DeceptiveDevelopment, employs sophisticated social engineering tactics to deliver threatening software under the guise of legitimate tools or interactions.

Social Engineering at the Core of Contagious Interview

The Contagious Interview campaign relies heavily on social engineering, with the attackers posing as recruiters. They exploit individuals seeking job opportunities, luring them into downloading malevolent software during a fabricated interview process. This is achieved through the distribution of compromised videoconferencing applications or npm packages hosted on platforms like GitHub or official package registries. Such methods have enabled the deployment of malware families like BeaverTail and InvisibleFerret.

Tracing the Threat

Security researchers, who first documented this activity in November 2023, have tracked the campaign under the identifier CL-STA-0240. The hacking group is also referred to by aliases such as the Famous Chollima and the Tenacious Pungsan. By September 2024, researchers uncovered significant updates to the attack chain, including an evolved version of BeaverTail. This update introduced modular capabilities, delegating its data-theft operations to Python scripts collectively named CivetQ.

Distinction from Operation Dream Job

Despite its similarities to the Operation Dream Job, another job-related North Korean cyber campaign, Contagious Interview remains distinct. Both campaigns employ job-themed decoys, but their infection methodologies and toolsets diverge. This underscores the varied approaches North Korean threat actors utilize to target victims.

OtterCookie’s Role in the Updated Attack Chain

Recent findings have highlighted OtterCookie as a critical component in the Contagious Interview arsenal. The malware, introduced in September 2024, operates in tandem with BeaverTail, fetching and executing its payload via a Command-and-Control (C2) server. Using the Socket.IO JavaScript library, OtterCookie can execute shell commands to exfiltrate sensitive data such as files, clipboard content and cryptocurrency wallet keys.

Evolving Capabilities: OtterCookie Variants

The initial version of OtterCookie incorporated a direct cryptocurrency wallet key theft mechanism within its codebase. However, a revised variant, detected in late 2024, shifted this feature to remote execution via shell commands. This adaptation illustrates the attackers' ongoing efforts to refine their tools while maintaining an effective infection chain.

Implications of Continuous Tool Updates

The introduction of OtterCookie and its updated variants demonstrates that the Contagious Interview campaign is far from stagnant. By enhancing their malware capabilities while leaving their attack methodology largely unchanged, the threat actors affirm the campaign's continued success and adaptability in targeting unsuspecting victims.