InvisibleFerretMalware
InvisibleFerret is a modular python malware that is leveraged for data exfiltration and remote access capabilities. InvisibleFerret consists of four modules: main, payload, browser, and AnyDesk. InvisibleFerret malware has been leveraged by North Korea-affiliated threat actors identified as DeceptiveDevelopment or Contagious Interview since 2023.From MITRE ATT&CK
Last reported 1 month ago, by Infosecurity Magazine6 reports
ATT&CK techniques
6 of 48 · each with the sentence it comes from- T1056.001Keylogging
“T1056.001: Input Capture: Keylogging”
- T1213.003Code Repositories
“During technical interviews or coding assignments, victims were told to download and run files hosted on developer platforms and code repositories.”
- T1041Exfiltration Over C2 Channel
“T1041: Exfiltration Over C2 Channel”
- T1053.005Scheduled Task
“We presume that the additional payload or new updates to the code will involve installing AnyDesk, and creating a scheduled task for it.”
- T1056Input Capture
“T1056.001: Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“T1059.006: Command and Scripting Interpreter: Python”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
North Korean Attackers Hit 30,000 Devices and Steal $10.7m“The actors seeded malicious NPM packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.”
-
Lazarus ClickFake Interview Campaign: ClickFix Malware“In some cases, BeaverTail downloads a second-stage payload called InvisibleFerret.”
-
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware“Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware”
-
Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories“…om their toolset by simply updating the blockchain reference, including other malware that have been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in Void Dokkaebi’s operations.”
-
Six Supply Chain Attack Groups to Watch Out for in 2026“…d as job interviews, unknowingly deploying malware such as BeaverTail (a JavaScript-based credential and crypto wallet stealer) and InvisibleFerret (a Python backdoor enabling persistent access and data exfiltration).”
-
APT Lazarus: Eager Crypto Beavers, Video calls and Games“…ownloading and running a Node.js project which contains the BeaverTail malware, which in turn delivers the Python backdoor known as InvisibleFerret.”
Indicators in its reports
named in the reports above- hxxp://ip-api[.]com/jsonin 1 report
- 45.59.160[.]199in 1 report
- socket[.]ioin 1 report
- api.trongrid[.]ioin 1 report
- fullnode.mainnet.aptoslabs[.]comin 1 report
- 136.0.9[.]8in 1 report
- 198.105.127[.]210in 1 report
- 23.27.202[.]27in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.