Beaver Tail and Otter Cookie evolve with a new Javascript module
Summary: Cisco Talos detailed a Famous Chollima campaign, attributed to a Lazarus subgroup aligned with DPRK economic interests, in which a Sri Lankan organization had one system infected through a trojanized Node.js application called Chessfi delivered via a fake job interview. Talos found the sample merged BeaverTail and OtterCookie code and added a previously undocumented keylogging and screenshotting module that flushes keystrokes every second, captures a screenshot every four seconds, and uploads both to a C2 server at 172.86.88.188 on TCP port 1478.
Why it matters: The keylogger writes keystrokes to a file named 1.tmp in the user's temporary windows-cache folder and screenshots to 2.jpeg in the same place, so an attacker with this module running has a rolling record of everything typed and seen on that host. Talos also found a fake VS Code onboarding extension and repositories pushed through Discord, which suggests the delivery routes are widening beyond the fake-interview lure.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026