This threat is a Node.js-based stealer malware with cross-platform capabilities targeting Windows (including WSL), macOS, and Linux. It is composed of three main modules: (1) a browser credential stealer supporting numerous Chromium-based browsers and wallet extensions, (2) a recursive file exfiltration scanner searching for sensitive files by extensive filename and extension patterns, and (3) a WebSocket reverse shell connecting to a DPRK OtterCookie C2 server at IP 216.126.225.243 over ports 8085, 8086, and 8087. The malware is obfuscated using typical obfuscation.io techniques, but the payloads are embedded in plaintext Base64 strings. Communications use the Axios NPM package, and a hardcoded HMAC key is used for encryption. The sample was analyzed statically due to sandbox execution failure. No patch or remediation guidance is available, and no known exploitation in the wild has been reported.

The malware can steal browser credentials from a wide range of Chromium-based browsers and their wallet extensions, potentially compromising user accounts and cryptocurrency wallets. It can also exfiltrate sensitive files from the victim's filesystem based on a broad set of filename and extension patterns, risking exposure of confidential data such as keys, passwords, configurations, and documents. Additionally, it establishes a reverse shell allowing remote command execution by the attacker. This combination of data theft and remote access can lead to significant confidentiality and integrity breaches on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a malware threat rather than a software vulnerability, remediation involves detection and removal of the malicious Node.js files and blocking network communications to the identified C2 IP address (216.126.225.243) on ports 8085, 8086, and 8087. Monitoring for suspicious Node.js processes and unusual outbound connections from development or user environments is recommended. No official fix or patch is available as this is malware rather than a vulnerability in a vendor product.