WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
Researchers discovered WeaselBiscuit, a stripped-down JavaScript stealer delivered via 13 malicious npm packages, harvesting Chrome extension storage with suspected DPRK links.
OpenSourceMalware identified 13 npm packages, including @biz44/id10-client and process-tailwind, delivering a previously undocumented stealer named WeaselBiscuit. Triggered on npm import, a loader.js pulls the payload from an Npoint dead drop, executes it in memory, and harvests Chrome extension storage (LevelDB) on Windows, macOS, and Linux, with clipboard and keylogging on Windows via C2 at 103.170.217.184:8787. It shares tradecraft with DPRK Contagious Interview's BeaverTail and OtterCookie, including Npoint.io usage and numerical campaign IDs, but definitive attribution is not established.
- 13 malicious npm packages deliver loader.js pulling payloads from Npoint dead drops
- Harvests Chrome extension Local Extension Settings (LevelDB) across Windows, macOS, Linux
- Shares tradecraft with DPRK's BeaverTail and OtterCookie but attribution unconfirmed
- Supports clipboard and keystroke logging on Windows via C2 at 103.170.217.184:8787
- Lacks persistence, wallet draining, and secondary payloads like InvisibleFerret
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1059.007 JavaScript/JScriptT1056.001 KeyloggingT1115 Clipboard DataT1555.003 Credentials from Web Browsers
- Vendors
- OpenSourceMalware
- Products
- npm
- Threat actors
- DPRK Contagious Interview
- Organizations
- OpenSourceMalware
- Countries
- North Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.170.217.184 | x. Based on operator commands received from the C2 server ("103.170.217[.]184:8787"), it can also log clipboard contents and keystrokes |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.