Weasel Biscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
Summary: Researchers at OpenSourceMalware found 13 npm packages delivering a previously undocumented JavaScript stealer called WeaselBiscuit, which shares functional overlap with the DPRK-linked BeaverTail and OtterCookie malware but lacks remote access, persistence, crypto wallet-draining code, and secondary payload delivery. Triggered by an npm import, its loader pulls the malware from an Npoint dead drop and runs it in memory, then harvests Chrome extension storage on Windows, macOS, and Linux and can log clipboard contents and keystrokes on Windows via a command-and-control server at 103.170.217[.]184:8787.
What you should know: The stealer uploads every readable, nonempty file under each extension's Local Extension Settings directory wholesale, so wallet-extension state and other extension-held secrets can be exposed even without dedicated wallet-draining code. OpenSourceMalware says there is no definitive evidence tying the operation to North Korea despite the tooling overlap, leaving attribution unresolved.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026