ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware
A group associated with North Korea, known as WaterPlum's Cluster B, has advanced its techniques by deploying OtterCandy, a Node.js-based remote access tool (RAT) and information stealer, as part of the ClickFake Interview campaign. Significant…
A group associated with North Korea, known as WaterPlum's Cluster B, has advanced its techniques by deploying OtterCandy, a Node.js-based remote access tool (RAT) and information stealer, as part of the ClickFake Interview campaign. Significant enhancements were observed in August 2025.
The threat actor, linked to North Korea, is responsible for two main campaigns: Contagious Interview and ClickFake Interview. Within WaterPlum, multiple clusters are active; however, Cluster B, also called the BlockNovas cluster, is notable for independently developing unique tools, including the OtterCandy malware.
ClickFake Interview employs deceptive web content to entice targets into interacting with malicious pages. Recently, cybersecurity researchers have documented an increase in attacks from WaterPlum, also known as Famous Chollima and PurpleBravo.
In Cluster B's implementation, victims encounter a customized "ClickFix" webpage disguised as an interview platform. Upon interaction, users are prompted to download what appears to be an interview application or document.
Previously, Cluster B distributed GolangGhost for Windows and FrostyFerret for macOS, similar to tactics used by other clusters. However, beginning in July 2025, OtterCandy became the primary implant for Windows, macOS, and Linux systems .
The campaign reflects WaterPlum's broader strategy of alternating between shared malware frameworks and proprietary strains to complicate detection and attribution. OtterCandy combines features from two earlier payloads—RATatouille and OtterCookie—to present a multifaceted threat.
The threat actor, linked to North Korea, is responsible for two main campaigns: Contagious Interview and ClickFake Interview.
OtterCandy is developed in Node.js and utilizes the Socket.IO library for real-time command-and-control (C2) communications. A sample matching OtterCandy's signature was first identified on VirusTotal in February 2025, initially misidentified as OtterCookie . Subsequent forensic analysis confirmed its lineage within the WaterPlum ecosystem.
Upon establishing a C2 connection, OtterCandy accepts various commands aimed at credential theft and system reconnaissance. Cluster B operators use these functions to harvest browser credentials, extract cryptocurrency wallets, and exfiltrate confidential documents from compromised devices.
Although OtterCandy relies on a secondary implant, DiggingBeaver, for persistence, it includes a self-relaunch mechanism: upon receiving a SIGINT event, the malware relaunches itself using Node.js's process.on handler.
In August 2025, analysts observed substantial revisions to OtterCandy, categorized as versions v1 and v2. These enhancements demonstrate Cluster B's commitment to iterative improvements and evasion techniques.
Adding client_id: OtterCandy's v1 transmitted a "username" field to identify victims. Version 2 introduces a unique "client_id," enabling precise tracking of infected hosts and streamlining operator control over large botnets. Expanding theft targets: While v1 targeted four browser extension IDs, v2 expands to seven, increasing the range of compromised artifacts. Additionally, v1's partial data exfiltration from Chromium-based browsers is replaced with comprehensive extraction of all available user data in v2. Trace deletion enhancements: Version 2 enhances its cleanup routines with the ss_del command, removing registry keys used by DiggingBeaver for persistence and purging associated files and directories to thwart forensic investigations.
The emergence of OtterCandy highlights Cluster B's growing sophistication and the evolving threat landscape posed by WaterPlum. Organizations in high-risk sectors, particularly in Japan, should increase monitoring of Node.js-based anomalies and Socket.IO traffic patterns.
Proactive threat hunting for duplicated client_id signatures and unexpected registry modifications can expedite detection. Continuous threat intelligence sharing and timely patching of development frameworks remain critical. Security teams should deploy behavioral analysis tools capable of flagging unusual process activity, enforce strict application whitelisting, and conduct regular audits of browser extension inventories.
As WaterPlum's Cluster B refines its malware arsenal, defenders must adapt by integrating dynamic analysis into their security operations and fostering collaboration across industry peers. Ongoing close monitoring of OtterCandy's evolution will be vital to mitigating the next wave of ClickFake Interview assaults.
OtterCandy's August 2025 enhancements represent a calculated escalation in WaterPlum’s operational tactics. Vigilant monitoring and robust defensive postures are necessary to address this more formidable threat. Continuous analysis will be essential to safeguarding critical infrastructure and sensitive data against this North Korean-linked adversary.
Based on reporting by GBHackers.