BeavertailMalware
BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview.From MITRE ATT&CK
Last reported 1 month ago, by Infosecurity Magazine7 reports
ATT&CK techniques
6 of 49 · each with the sentence it comes from- T1056.001Keylogging
“T1056.001: Input Capture: Keylogging”
- T1213.003Code Repositories
“During technical interviews or coding assignments, victims were told to download and run files hosted on developer platforms and code repositories.”
- T1552.004Private Keys
“The modules loaded malicious code that extracted and stole crypto-wallet private keys.”
- T1041Exfiltration Over C2 Channel
“T1041: Exfiltration Over C2 Channel”
- T1053.005Scheduled Task
“We presume that the additional payload or new updates to the code will involve installing AnyDesk, and creating a scheduled task for it.”
- T1056Input Capture
“T1056.001: Input Capture: Keylogging”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
North Korean Attackers Hit 30,000 Devices and Steal $10.7m“The actors seeded malicious NPM packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.”
-
Risky Bulletin: Gemini hacked three companies too“…vaScript-based infostealer named WeaselBiscuit, which appears to be a stripped-down version of previous North Korean infostealers like BeaverTail and OtterCookie.”
-
Lazarus ClickFake Interview Campaign: ClickFix Malware“During the meeting, they were asked to download a project on GitHub, which was infected by the BeaverTail infostealer.”
-
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware“BeaverTail has also expanded beyond its original downloader and stealer role into a broader malware with overlapping functions, including credential harvesting and wallet trojanization.”
-
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories“…ence, including other malware that have been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in Void Dokkaebi’s operations.”
-
Six Supply Chain Attack Groups to Watch Out for in 2026“…rs install them as part of sophisticated spearphishing activities masqueraded as job interviews, unknowingly deploying malware such as BeaverTail (a JavaScript-based credential and crypto wallet stealer) and InvisibleFerret (a Python backdoor enabling persistent access and data e…”
-
APT Lazarus: Eager Crypto Beavers, Video calls and Games“We will examine their recent Python scripts, including the CivetQ and BeaverTail malware variants, along with their updated versions in Windows and Python releases.”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- hxxp://ip-api[.]com/jsonin 1 report
- 45.59.160[.]199in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.