StoatWaffleMalware
StoatWaffle Malware is a lightweight JavaScript-based backdoor trojan active since at least October 2025 that enables persistent, stealthy remote control over infected systems by continuously beaconing to a command-and-control server approximately every 5 seconds.From MISP Galaxy
Last reported 1 month ago, by Infosecurity Magazine1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1213.003Code Repositories
“During technical interviews or coding assignments, victims were told to download and run files hosted on developer platforms and code repositories.”
- T1552.004Private Keys
“Once inside, the actors used remote access trojans and infostealers to take browser credentials, keystrokes, screenshots, wallet private keys and seed phrases, and ID documents.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
North Korean Attackers Hit 30,000 Devices and Steal $10.7m“The actors seeded malicious NPM packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.”
Thanks — we review every report.