WaterPlum Deploys New ‘StoatWaffle’ Malware in VSCode-Based Supply Chain Campaign
WaterPlum, a hacking group with links to North Korea, has developed a new malware named StoatWaffle. This malware is distributed via compromised Visual Studio Code (VSCode) repositories that are disguised as legitimate blockchain development projects,…
WaterPlum, a hacking group with links to North Korea, has developed a new malware named StoatWaffle. This malware is distributed via compromised Visual Studio Code (VSCode) repositories that are disguised as legitimate blockchain development projects, allowing it to covertly infiltrate developer systems.
The group's campaign, known as "Contagious Interview," involves deceiving victims into executing harmful code under the pretense of job interviews. Team 8, also referred to as Moralis or Modilus, is responsible for this campaign. They previously utilized the OtterCookie malware family but have transitioned to deploying StoatWaffle as of December 2025.
NTT Security analysts have identified StoatWaffle as a significant advancement in WaterPlum's operational strategy. The malware is a modular Node.js-based framework comprising a loader, a credential-stealing module, and a remote access trojan (RAT), which collectively provide attackers with extensive access to compromised systems.
The attack begins with a seemingly authentic blockchain project repository shared among developers. A hidden .vscode folder contains a tasks.json file configured with a runOn: folderOpen setting. When a developer opens this folder in VSCode and grants trust, the editor executes a pre-set task automatically.
WaterPlum, a hacking group with links to North Korea, has developed a new malware named StoatWaffle.
The malicious task downloads a batch script called vscode-bootstrap.cmd from a Vercel-hosted application, which checks for Node.js installation. If Node.js is absent, it installs it discreetly and proceeds to download a JavaScript file named env.npl , initiating the infection chain.
The env.npl file connects to a C2 server at 147[.]124.202.208 on port 3000, polling the /api/errorMessage endpoint every five seconds. Upon receiving an error status, the loader executes embedded JavaScript code to fetch the second-stage payload. The second downloader targets the /api/handleErrors endpoint, spawning hidden processes to remain undetected.
Once active, StoatWaffle deploys both Stealer and RAT modules. The Stealer targets saved browser credentials and cryptocurrency wallet data across Chromium-based and Firefox browsers, as well as the Keychain database on macOS. The RAT module can execute commands and manage files, providing extensive control over the infected system.
Developers are advised to exercise caution with unverified VSCode repositories, especially those related to blockchain or cryptocurrency. Reviewing VSCode workspace trust settings and enforcing policies against runOn: folderOpen behavior is recommended. Security teams should block these indicators of compromise: 185[.]163.125.196 , 147[.]124.202.208 , 163[.]245.194.216 , 66[.]235.168.136 , and 87[.]236.177.9 .
Monitoring for unexpected Node.js installations or hidden processes spawned from VSCode may serve as early indicators of compromise.
Based on reporting by Cyber Security News.