Threat Research

A North Korea-aligned group, Famous Chollima, is using fake job offers to lure victims into installing malware. In a recent case, a trojanized Node.js app called Chessfi was distributed via the NPM package node-nvm-ssh. The group’s tools, BeaverTail and OtterCookie, have evolved by merging functionalities and adding a new JavaScript module for keylogging and taking screenshots....

OtterCookie, a new malware used by Contagious Interview, is part of an ongoing attack campaign attributed to North Korea, which has been financially motivated rather than politically targeted. Observed by SOCs since November 2024, OtterCookie represents a new variant in the Contagious Interview campaign, which previously featured malware like BeaverTail and InvisibleFerret....