WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

WeaselBiscuit is a JavaScript infostealer malware distributed through 11 malicious npm packages. It executes a detached Node.js process, retrieves payloads from Npoint URLs, and communicates with a command-and-control server at 103.170.217.184:8787. The malware profiles infected hosts, steals Chrome extension storage related to wallet signing states, captures clipboard contents, and logs Windows keystrokes on command. It is a stripped-down variant of DPRK-linked BeaverTail and OtterCookie malware families, lacking wallet draining, password decryption, screenshot capture, and remote shell capabilities. Numeric campaign identifiers in package names are used for infection tracking. Attribution to DPRK is suggested but not definitive.

• Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code RepositoriesMalware2026-04-21
• Tracking an OtterCookie Infostealer Campaign Across npmMalware2026-04-13
• Contagious Interview Actors Now Utilize JSON Storage Services for Malware DeliveryMalware2025-11-14
• From primitive crypto theft to sophisticated AI-based deceptionMalware2025-11-09
• Evolving with a new Javascript moduleMalware2025-10-16