New ‘OtterCookie’ malware used to backdoor devs in fake job offers

Share:

North Korean threat actors are using new malware called OtterCookie in the Contagious Interview campaign that is targeting software developers.

Contagious Interview has been active since at least December 2022, according to researchers at cybersecurity company Palo Alto Networks. The campaign targets software developers with fake job offers to deliver malware such as BeaverTail and InvisibleFerret.

A report from NTT Security Japan notes that the Contagious Interview operation is now using a new piece of malware called OtterCookie, which was likely introduced in September and with a new variant appearing in the wild in November.

OtterCookie attack chain

Just like in the attacks documented by Palo Alto Networks’ Unit42 researchers, OtterCookie is delivered via a loader that fetches JSON data and executes the ‘cookie’ property as JavaScript code.

NTT says that, even though BeaverTail remains the most common payload, OtterCookie has been seen in some cases either deployed alongside BeaverTail or on its own.

The loader infects targets through Node.js projects or npm packages downloaded from GitHub or Bitbucket. However, files built as Qt or Electron applications were also used recently.

Overview of the latest Contagious Interview attacks
Overview of the latest Contagious Interview attacks
Source: NTT Japan

Once active on the target device, OtterCookie establishes secure communications with its command and control (C2) infrastructure using the Socket.IO WebSocket tool, and awaits for commands.

The researchers observed shell commands that perform data theft (e.g. collecting cryptocurrency wallet keys, documents, images, and other valuable information).

“The September version of OtterCookie already included a built-in functionality to steal keys related to cryptocurrency wallets,” NTT explains.

“For example, the checkForSensitiveData function used regular expressions to check for Ethereum private keys,” the researchers note, adding that this was changed with the November variant of the malware where this is achieved through remote shell commands.

The latest version of OtterCookie can also exfiltrate clipboard data to the threat actors, which may contain sensitive information.

Commands typically used for reconnaissance, like ‘ls’ and ‘cat’, were also detected, indicating the attacker’s intention to explore the environment and stage it for deeper infiltration or lateral movement.

The appearance of new malware and the diversification of the infection methods indicate that the threat actors behind the Contagious Interview campaign experiment with new tactics.

Software developers should try to verify information about a potential employer and be wary of running code on personal or work computers as part of a job offer that require coding tests.

Source

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
7:14 pm, Feb 15, 2025
weather icon 3°C
L: 2° | H: 5°
light rain
Humidity: 87 %
Pressure: 1019 mb
Wind: 8 mph E
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0.18 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 8 km
Sunrise: 7:14 am
Sunset: 5:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
2° | 5°°C 1 mm 100% 7 mph 89 % 1019 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
2° | 4°°C 1 mm 100% 10 mph 91 % 1022 mb 0.24 mm/h
Mon Feb 17 9:00 pm
weather icon
1° | 7°°C 0 mm 0% 7 mph 78 % 1022 mb 0 mm/h
Tue Feb 18 9:00 pm
weather icon
1° | 8°°C 0 mm 0% 8 mph 70 % 1022 mb 0 mm/h
Wed Feb 19 9:00 pm
weather icon
4° | 10°°C 0 mm 0% 7 mph 94 % 1020 mb 0 mm/h
Today 9:00 pm
weather icon
2° | 3°°C 1 mm 100% 7 mph 89 % 1019 mb 0 mm/h
Tomorrow 12:00 am
weather icon
2° | 2°°C 1 mm 100% 7 mph 91 % 1020 mb 0.24 mm/h
Tomorrow 3:00 am
weather icon
2° | 2°°C 0 mm 0% 6 mph 90 % 1019 mb 0 mm/h
Tomorrow 6:00 am
weather icon
2° | 2°°C 0 mm 0% 6 mph 88 % 1020 mb 0 mm/h
Tomorrow 9:00 am
weather icon
3° | 3°°C 0 mm 0% 8 mph 80 % 1020 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
4° | 4°°C 0 mm 0% 10 mph 69 % 1021 mb 0 mm/h
Tomorrow 3:00 pm
weather icon
4° | 4°°C 0 mm 0% 9 mph 64 % 1021 mb 0 mm/h
Tomorrow 6:00 pm
weather icon
3° | 3°°C 0 mm 0% 8 mph 69 % 1021 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€93,044.61
-0.80%
Ethereum(ETH)
€2,577.08
-1.97%
XRP(XRP)
€2.64
-0.47%
Tether(USDT)
€0.95
-0.02%
Solana(SOL)
€185.71
-4.22%
USDC(USDC)
€0.95
0.01%
Dogecoin(DOGE)
€0.262130
-1.39%
Shiba Inu(SHIB)
€0.000015
-3.44%
Pepe(PEPE)
€0.000010
-5.12%
Scroll to Top