www.bleepingcomputer.com
Open in
urlscan Pro
104.20.184.56
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/new-ottercookie-malware-used-to-backdoor-devs-in-fake-job-offers/
Submission: On December 27 via api from TR — Scanned from DE
Submission: On December 27 via api from TR — Scanned from DE
Form analysis 4 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/new-ottercookie-malware-used-to-backdoor-devs-in-fake-job-offers/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/new-ottercookie-malware-used-to-backdoor-devs-in-fake-job-offers/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" spellcheck="false" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" spellcheck="false" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/new-ottercookie-malware-used-to-backdoor-devs-in-fake-job-offers/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised advertising and content, advertising and
content measurement, audience research and services development. With your
permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
1466 partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences or
withdraw your consent at any time by returning to this site and clicking the
"Privacy" button at the bottom of the webpage.
Please note that this website/app uses one or more Google services and may
gather and store information including but not limited to your visit or usage
behaviour. You may click to grant or deny consent to Google and its third-party
tags to use your data for below specified purposes in below Google consent
section.
MORE OPTIONSAGREE
*
*
*
*
*
*
*
*
* News
* Featured
* Latest
* Clop ransomware is now extorting 66 Cleo data-theft victims
* FBI links North Korean hackers to $308 million crypto heist
* Adobe warns of critical ColdFusion bug with PoC exploit code
* Microsoft fixes bug behind random Office 365 deactivation errors
* Expand your resume by studying any of 1,000+ courses in this three-part
bundle
* Apache warns of critical flaws in MINA, HugeGraph, Traffic Control
* New 'OtterCookie' malware used to backdoor devs in fake job offers
* Windows 11 installation media bug causes security update failures
* Tutorials
* Latest
* Popular
* How to access the Dark Web using the Tor Browser
* How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11
* How to use the Windows Registry Editor
* How to backup and restore the Windows Registry
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* Remove the Theonlinesearch.com Search Redirect
* Remove the Smartwebfinder.com Search Redirect
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* VPNs
* Popular
* Best VPNs
* How to change IP address
* Access the dark web safely
* Best VPN for YouTube
* Forums
* More
* Startup Database
* Uninstall Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* New 'OtterCookie' malware used to backdoor devs in fake job offers
*
*
NEW 'OTTERCOOKIE' MALWARE USED TO BACKDOOR DEVS IN FAKE JOB OFFERS
By
BILL TOULAS
* December 26, 2024
* 11:53 AM
* 0
North Korean threat actors are using new malware called OtterCookie in the
Contagious Interview campaign that is targeting software developers.
Contagious Interview has been active since at least December 2022, according to
researchers at cybersecurity company Palo Alto Networks. The campaign targets
software developers with fake job offers to deliver malware such as BeaverTail
and InvisibleFerret.
A report from NTT Security Japan notes that the Contagious Interview operation
is now using a new piece of malware called OtterCookie, which was likely
introduced in September and with a new variant appearing in the wild in
November.
OTTERCOOKIE ATTACK CHAIN
Just like in the attacks documented by Palo Alto Networks' Unit42 researchers,
OtterCookie is delivered via a loader that fetches JSON data and executes the
‘cookie’ property as JavaScript code.
NTT says that, even though BeaverTail remains the most common payload,
OtterCookie has been seen in some cases either deployed alongside BeaverTail or
on its own.
The loader infects targets through Node.js projects or npm packages downloaded
from GitHub or Bitbucket. However, files built as Qt or Electron applications
were also used recently.
Overview of the latest Contagious Interview attacks
Source: NTT Japan
Once active on the target device, OtterCookie establishes secure communications
with its command and control (C2) infrastructure using the Socket.IO WebSocket
tool, and awaits for commands.
The researchers observed shell commands that perform data theft (e.g. collecting
cryptocurrency wallet keys, documents, images, and other valuable information).
“The September version of OtterCookie already included a built-in functionality
to steal keys related to cryptocurrency wallets,” NTT explains.
“For example, the checkForSensitiveData function used regular expressions to
check for Ethereum private keys,” the researchers note, adding that this was
changed with the November variant of the malware where this is achieved through
remote shell commands.
Targeting cryptocurrency information
Source: NTT Japan
The latest version of OtterCookie can also exfiltrate clipboard data to the
threat actors, which may contain sensitive information.
Commands typically used for reconnaissance, like ‘ls’ and ‘cat’, were also
detected, indicating the attacker’s intention to explore the environment and
stage it for deeper infiltration or lateral movement.
The appearance of new malware and the diversification of the infection methods
indicate that the threat actors behind the Contagious Interview campaign
experiment with new tactics.
Software developers should try to verify information about a potential employer
and be wary of running code on personal or work computers as part of a job
offer that require coding tests.
RELATED ARTICLES:
Radiant links $50 million crypto heist to North Korean hackers
North Korean hackers use new macOS malware against crypto firms
FBI links North Korean hackers to $308 million crypto heist
North Korean hackers stole $1.3 billion worth of crypto this year
Crypto-stealing malware posing as a meeting app targets Web3 pros
* CryptoCurrency
* Interview
* Job Offer
* Malware
* North Korea
* OtterCookie
*
*
*
*
*
BILL TOULAS
Bill Toulas is a tech writer and infosec news reporter with over a decade of
experience working on various online publications, covering open-source, Linux,
malware, data breach incidents, and hacks.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* New botnet exploits vulnerabilities in NVRs, TP-Link routers
* Apache fixes remote code execution bypass in Tomcat web server
* Adobe warns of critical ColdFusion bug with PoC exploit code
Sponsor Posts
* Latrodectus malware and how to defend against it with Wazuh
* Have Your AD Password Policy Meet NIST Requirements
* Cynet Delivers 100% Protection and 100% Detection Visibility in 2024 MITRE
ATT&CK Evaluation
* Inside the incident: Uncovering an advanced phishing attack
* Save IT time with self-service password resets
FOLLOW US:
*
*
*
*
*
MAIN SECTIONS
* News
* VPN Buyer Guides
* SysAdmin Software Guides
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure
Copyright @ 2003 - 2024 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT