Malware

BeaverTail

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 18, 2026 · last 10h ago

Timeline2 articles

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Researchers discovered WeaselBiscuit, a stripped-down JavaScript stealer delivered via 13 malicious npm packages, harvesting Chrome extension storage with suspected DPRK links.

OpenSourceMalware identified 13 npm packages, including @biz44/id10-client and process-tailwind, delivering a previously undocumented stealer named WeaselBiscuit. Triggered on npm import, a loader.js pulls the payload from an Npoint dead drop, executes it in memory, and harvests Chrome extension storage (LevelDB) on Windows, macOS, and Linux, with clipboard and keylogging on Windows via C2 at 103.170.217.184:8787. It shares tradecraft with DPRK Contagious Interview's BeaverTail and OtterCookie, including Npoint.io usage and numerical campaign IDs, but definitive attribution is not established.

The Hacker News10:40 UTC · 10h agoMalware in the wild

North Korean hackers infect thousands of devices across 100 countries as part of ‘WaterPlum’ campaign

FBI and Japanese police advisory ties North Korea's WaterPlum campaign to $10.5M stolen from job seekers via fake-recruiter malware on 30,000 devices.

A joint advisory from the FBI, US Defense Department, Japan's National Police Agency and partners describes 'WaterPlum', North Korean cyber actors posing as AI and blockchain companies to recruit job seekers. Between December 2025 and July 2026 the group infected at least 30,000 devices across 100 countries and stole funds or credentials from about 7,000 cryptocurrency wallets, totaling over $10.5 million. Victims, mostly web designers, engineers and crypto specialists in Japan and elsewhere, were contacted via social media and freelance portals and told to download files during interviews, leading to infection with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle malware plus remote management tools. The campaign is intertwined with DPRK IT-worker laptop-farm schemes and is attributed to North Korea's General Bureau of the Munitions Industry Department; Japanese police disrupted a laptop farm for the first time.

The Recordupdated 15:48 UTC · 4h agofirst 04:00 UTC · 16h agoThreat actor in the wild 3 sources

Appears with

malware OtterCookie 2 threat actor General Bureau of the Munitions Industry Department 1 threat actor North Korea 1 threat actor WaterPlum 1 malware InvisibleFerret 1 malware OtterCandy 1 malware StoatWaffle 1 malware WeaselBiscuit 1 organization Defense Department 1 organization Disney 1 organization FBI 1 organization Google 1 organization LinkedIn 1 organization National Police Agency 1 organization OpenSourceMalware 1 organization Oracle 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.