Threat Actors Leveraging ClickFake Interview Attack to Deploy OtterCandy Malware
WaterPlum, a North Korean threat group, has advanced its operations with the introduction of a new malware strain named OtterCandy. This malware acts as both a cross-platform Remote Access Trojan (RAT) and an information stealer.
WaterPlum, a North Korean threat group, has advanced its operations with the introduction of a new malware strain named OtterCandy. This malware acts as both a cross-platform Remote Access Trojan (RAT) and an information stealer.
Technical Specifications and Deployment
OtterCandy integrates features from previous malware families, RATatouille and OtterCookie, enhancing its capability for credential theft and system compromise. The malware is part of WaterPlum's ClickFake Interview campaign, targeting individuals in the blockchain and cryptocurrency sectors through deceptive job recruitment processes.
NTT Security researchers have identified OtterCandy's deployment across Windows, macOS, and Linux platforms since July 2025. The malware's reach extends globally, with notable activity in Japan and other regions.
Built using Node.js, OtterCandy communicates with command-and-control servers via Socket.IO connections. It supports a wide range of malicious activities, including:
WaterPlum, a North Korean threat group, has advanced its operations with the introduction of a new malware strain named OtterCandy.
Home directory sweeps using the 'imp' function Pattern-based file searches with the 'pat' function Extraction of system information, browser credentials, and cryptocurrency wallet data using the 'upload' function
Advanced Persistence and Evasion Mechanisms
OtterCandy employs a multi-layered persistence strategy, ensuring continued operation even after detection attempts. It incorporates an independent backup mechanism to restart processes upon interruption. This functionality utilizes JavaScript's process event handling to monitor for SIGINT signals.
function startChildProcess() { const _0x4777b5 = fork(path'join', [], { 'detached': true, 'stdio': 'ignore' }); _0x4777b5['unref'](); }
process'on' => { startChildProcess(); process['exit'](); });
The August 2025 update to OtterCandy introduced enhanced anti-forensic capabilities, including trace deletion functions that remove registry entries, downloaded files, and temporary directories. This cleanup mechanism operates via the 'ss_del' command, erasing evidence of compromise to maintain operational security.
Based on reporting by Cyber Security News.