OtterCandyMalware
- hardhatrat
- unseenmink
OtterCandy is a JavaScript backdoor that uses the Socket. IO WebSocket protocol over port 5000 for command and control and exfiltrates data via HTTP on port 3011. It focuses on credential theft from Chromium-based browsers (Chrome, Edge, Brave, Opera, Yandex) by decrypting SQLite login databases with Windows DPAPI, and it targets cryptocurrency wallets through both browser extension…From MISP Galaxy
Last reported 1 month ago, by Infosecurity Magazine1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1213.003Code Repositories
“During technical interviews or coding assignments, victims were told to download and run files hosted on developer platforms and code repositories.”
- T1552.004Private Keys
“Once inside, the actors used remote access trojans and infostealers to take browser credentials, keystrokes, screenshots, wallet private keys and seed phrases, and ID documents.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
North Korean Attackers Hit 30,000 Devices and Steal $10.7m“The actors seeded malicious NPM packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.”
Thanks — we review every report.