BeaverTail Archives • Daily CyberSecurity

North Korea-Aligned Void Dokkaebi Evolves with Binary Obfuscation

North Korea-Aligned Void Dokkaebi Evolves with Binary Obfuscation

Do Son May 28, 2026

TrendAI Research exposes the new Void Dokkaebi Cython malware campaign. Learn how InvisibleFerret uses binary compilation to evade security teams.

Inside “HexagonalRodent”: The AI-Powered DPRK Syndicate Hauling Millions in Crypto HexagonalRodent Malware Web3 Developer Scams

Inside “HexagonalRodent”: The AI-Powered DPRK Syndicate Hauling Millions in Crypto

Do Son April 27, 2026

North Korean group HexagonalRodent stole millions in Q1 2026 using AI-generated lures and backdoored VS Code tasks. Protect your Web3 wallet now.

Fake Jobs, Real Theft: “Contagious Interview” Malware Drains Crypto Wallets Contagious Interview Campaign MetaMask Malware

Fake Jobs, Real Theft: “Contagious Interview” Malware Drains Crypto Wallets

Do Son February 18, 2026

North Korean hackers target IT pros with "Contagious Interview" malware. Fake job offers install trojanized MetaMask extensions to steal crypto.

“Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms PurpleBravo Contagious Interview

“Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms

Do Son January 27, 2026

North Korean group PurpleBravo uses fake job offers to breach IT firms. The "Contagious Interview" campaign deploys malware via coding tests.

North Korea’s “Contagious Interview” Floods npm with 200 New Packages, Using Fake Crypto Jobs to Deploy OtterCookie Spyware BlueNoroff macOS Attack GhostCall Campaign Carding Underground Bulletproof Hosting DPRK Contagious Interview, npm Flood Stonefly group -HiatusRAT Actors

BlueNoroff macOS Attack GhostCall Campaign Carding Underground Bulletproof Hosting DPRK Contagious Interview, npm Flood Stonefly group -HiatusRAT Actors

North Korea’s “Contagious Interview” Floods npm with 200 New Packages, Using Fake Crypto Jobs to Deploy OtterCookie Spyware

Do Son December 1, 2025

North Korean APTs added 197 malicious npm packages to the "Contagious Interview" campaign. The operation uses fake crypto job assignments to deploy the OtterCookie/BeaverTail hybrid to steal credentials cross-platform.

North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware

Do Son November 17, 2025

NVISO exposed the Contagious Interview APT using JSON Keeper and npoint.io as covert C2 channels. The North Korean group uses fake job lures on GitLab to deploy BeaverTail to steal Web3 credentials.

North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft jobs

North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft

Do Son October 17, 2025

Cisco Talos exposed Famous Chollima using fake job offers and a trojanized Node.js app (Chessfi) to infect developers. The OtterCookie RAT steals crypto wallets, credentials, and source code.

North Korean APT “Contagious Interview” Floods npm Registry with 338 Malicious Packages to Steal Crypto North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean APT “Contagious Interview” Floods npm Registry with 338 Malicious Packages to Steal Crypto

Do Son October 11, 2025

North Korean actors launched "Contagious Interview," flooding npm with 338 malicious packages to deliver BeaverTail/InvisibleFerret. The campaign targets Web3 developers via fake job offers.

North Korean Hackers Evolve Tactics with New Malware Campaign North Korea malware North Korea, OFAC sanctions DPRK AI hiring, Wagemole campaigns

North Korea malware North Korea, OFAC sanctions DPRK AI hiring, Wagemole campaigns

North Korean Hackers Evolve Tactics with New Malware Campaign

Do Son September 19, 2025

GitLab Threat Intelligence reveals a new North Korean malware campaign using "ClickFix" social engineering to target new industries like crypto and retail.

XORIndex: North Korea’s Evolving Supply Chain Malware Targets npm Ecosystem Again NPM Supply Chain, North Korea Malware

XORIndex: North Korea’s Evolving Supply Chain Malware Targets npm Ecosystem Again

Do Son July 15, 2025

North Korean APTs are using XORIndex malware in a new npm supply chain attack, infiltrating developers via 67 malicious packages to steal crypto wallets and credentials.

North Korean APT Launches Massive npm Supply Chain Attack: Typosquatting & Fake Jobs Steal Crypto from Devs npm Supply Chain Attack, North Korean APT

npm Supply Chain Attack, North Korean APT

North Korean APT Launches Massive npm Supply Chain Attack: Typosquatting & Fake Jobs Steal Crypto from Devs

Do Son June 26, 2025

North Korean APTs are using 35 typosquatted npm packages and fake job offers to spread HexEval, BeaverTail, and InvisibleFerret malware, stealing crypto and data from developers.

North Korean APT ‘Contagious Interview’ Launches Fake Crypto Companies to Spread Malware Trio North Korea malware North Korea, OFAC sanctions DPRK AI hiring, Wagemole campaigns

North Korean APT ‘Contagious Interview’ Launches Fake Crypto Companies to Spread Malware Trio

Do Son April 28, 2025

Silent Push uncovers Lazarus Group's campaign using fake crypto job offers to spread malware (BeaverTail, InvisibleFerret, OtterCookie), targeting job seekers.

Russian IP Networks Fuel North Korea’s Global Cybercrime and Espionage Campaigns North Korea, Russian infrastructure

Russian IP Networks Fuel North Korea’s Global Cybercrime and Espionage Campaigns

Do Son April 25, 2025

Trend Micro reveals how Russian IP networks support North Korea’s cybercrime—from crypto theft to malware-laced fake job interviews and potential espionage.

Beware the Bait: BeaverTail and Tropidoor Malware Lurk in Recruitment Emails WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

Beware the Bait: BeaverTail and Tropidoor Malware Lurk in Recruitment Emails

Do Son April 4, 2025

Explore the dangers of Tropidoor malware and how deceptive emails can lead to cyber threats. Stay informed and protected.

North Korea’s IT Worker Scam: How the Regime Infiltrates Global Tech Firms for Cyber Espionage

Do Son February 16, 2025

Uncover the dangers of North Korea’s IT worker scam. Learn how it threatens global tech with espionage and fraud.

“OtterCookie” Malware Nibbles at Developers in “Contagious Interview” Campaign SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

“OtterCookie” Malware Nibbles at Developers in “Contagious Interview” Campaign

Do Son December 26, 2024

Discover the dangers of OtterCookie, a sneaky malware targeting software developers. Find out how it infiltrates systems and steals sensitive data.

Contagious Interview & WageMole: North Korea’s New Cyber Espionage Campaigns WageMole campaign

Contagious Interview & WageMole: North Korea’s New Cyber Espionage Campaigns

Do Son November 6, 2024

Uncover the deceptive strategies of North Korean threat actors infiltrating Western job markets through the Contagious Interview and WageMole campaigns.

North Korean Cyber Espionage Group Tenacious Pungsan Compromises Open-Source Repositories with Backdoored npm Packages Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

North Korean Cyber Espionage Group Tenacious Pungsan Compromises Open-Source Repositories with Backdoored npm Packages

Do Son October 24, 2024

Uncover the malicious activities of the Tenacious Pungsan group. Learn how they target developers through name-squatting attacks on popular npm packages.

Developers Targeted: North Korean Hackers Deploy “BeaverTail” Malware via NFTs

Do Son October 20, 2024

Learn about the sophisticated phishing campaign using a fraudulent NFT project to spread malware known as BeaverTail.

North Korean Threat Actors Targeting Tech Job Seekers with Contagious Interview Campaign

Do Son October 9, 2024

Beware of the Contagious Interview campaign: North Korean threat actors posing as recruiters target tech job seekers with malware.

North Korean Hackers Launch Job Interview Scam to Deploy BeaverTail and InvisibleFerret Malware BeaverTail malware

North Korean Hackers Launch Job Interview Scam to Deploy BeaverTail and InvisibleFerret Malware

Do Son September 5, 2024

Protect yourself from the BeaverTail malware and InvisibleFerret backdoor used by Lazarus Group. Learn how the Contagious Interview campaign targets blockchain professionals and job seekers through deceptive tactics.