North Korean hackers use "OtterCookie" malware in fake job offers targeting developers. Learn how this campaign works and steps to stay secure.
Continue reading
Cybersecurity researchers have uncovered "OtterCookie," a new malware strain used by North Korean threat actors in the ongoing "Contagious Interview" campaign targeting software developers. Active since at least December 2022, this operation has used fake job offers to deliver malicious payloads such as BeaverTail and InvisibleFerret. These payloads are designed to establish backdoors and enable data exfiltration, granting attackers unauthorized access to sensitive systems. OtterCookie, introduced in September 2023 with a new variant in November, marks an evolution in the campaign's tactics.
This campaign employs fake LinkedIn profiles and job descriptions mirroring real vacancies to trick developers into downloading malicious files disguised as coding tests or projects. OtterCookie is delivered via loaders fetching JSON data to execute JavaScript code, a technique that avoids detection by mimicking legitimate processes. By replicating typical developer workflows and leveraging trusted tools, the malware blends into regular activity, reducing the likelihood of raising suspicion during its execution. JavaScript’s ubiquity in development workflows, including its use in both front-end and back-end programming, makes it an attractive vector for attackers, as it is often trusted and widely executed across diverse environments, making it particularly effective against developers. The malware is spread through compromised Node.js projects, npm packages, and files built as Qt or Electron applications, increasing its reach.
Once deployed, OtterCookie establishes secure communication with its command-and-control (C2) infrastructure using Socket.IO WebSocket. Initial variants targeted cryptocurrency wallet keys using regular expressions, while newer versions rely on remote shell commands for broader data theft. OtterCookie can exfiltrate clipboard data and reconnaissance commands like ‘ls’ and ‘cat’, enabling attackers to list sensitive files, read configuration data, or locate credentials stored within the system. This reconnaissance often focuses on identifying access credentials, sensitive documents, and configuration files that could provide pathways to further infiltrate networks or escalate privileges within the target environment. For example, attackers could identify critical database credentials, access internal systems, and move laterally to compromise an organization's DevOps pipelines or deploy ransomware across the network, leading to significant operational and financial damages.
The November variant introduced advanced evasion techniques, including encrypted communication protocols, which disguise data exchange with the command-and-control server, and obfuscation, which conceals malicious code within legitimate-looking scripts to bypass security measures. For example, similar techniques have been used in the SolarWinds attack, where obfuscated code allowed attackers to remain undetected for months while exfiltrating sensitive data. These techniques make detection more difficult by masking malicious activities within seemingly legitimate processes and ensuring that traditional signature-based detection methods are less effective. Its clipboard exfiltration feature captures sensitive information, such as passwords and private keys, underscoring its potential impact on individuals and organizations.
A single ClickFix infrastructure is pushing StealC, Amatera, Remus, NetSupport, CastleLoader and a new loader called ResiLoader through fake Google/Cloudflare checks.
