WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

A threat group linked to North Korea, known as WaterPlum, has introduced a new malware strain named "StoatWaffle" as part of its ongoing Contagious Interview campaign.

This activity is attributed to Team 8, a subgroup within WaterPlum, also referred to as the Moralis or Modilus cluster. The group was previously associated with the OtterCookie malware, but researchers have identified a shift towards this newly developed toolset since December 2025.

The attack initiates with a malicious repository disguised as a legitimate blockchain-related project. Within this repository, attackers include a hidden .vscode directory containing a specially crafted tasks.json file. This file leverages the "runOn" configuration set to "folderOpen," which executes a predefined task automatically when a victim opens and trusts the repository in Visual Studio Code (VSCode).

The campaign targets developers, especially those involved in blockchain projects, by exploiting trusted development environments like VSCode. The script performs environment checks and ensures persistence of the attack chain by verifying the presence of Node.js. If Node.js is absent, it is downloaded and installed from the official source, ensuring cross-platform compatibility.

Once Node.js is available, the script downloads two additional files: env.npl and package.json. The env.npl file is executed, marking the transition into the StoatWaffle malware framework.

The triggered task downloads payload data from a Vercel-hosted web application. The payload is executed via cmd.exe and functions as a downloader, retrieving a secondary script named vscode-bootstrap.cmd. If the server responds with an error, the returned content is treated as executable Node.js code.

After several minutes of polling, the loader receives a second-stage payload. This second downloader communicates with a different endpoint, "/api/handleErrors," and continues executing commands from the command-and-control (C2) server.

The second stage quickly deploys both a stealer module and a remote access trojan (RAT), indicating a modular malware architecture. The env.npl file serves as the initial loader, establishing communication with the C2 server by polling the endpoint "/api/errorMessage" every five seconds.

The stealer module extracts sensitive data from multiple sources, targeting credentials stored in web browsers and collecting data from browser extensions. For Chromium-based browsers, the malware gathers extension data alongside saved credentials. In Firefox environments, it parses the extensions.json file to identify targeted extensions based on specific keywords before extracting related data. On macOS systems, the malware extends its reach to the Keychain database.

Collected data is staged in temporary directories using randomized filenames and then uploaded to the C2 server via the "/upload" endpoint. System profiling data, including installed software, is sent to a secondary endpoint, "/uploadsecond."

The malware is aware of the Windows Subsystem for Linux (WSL) and converts Windows file paths into Linux-compatible paths using wslpath, enabling access to Windows user data from within a Linux context.

The RAT module provides persistent control over the infected system, continuously communicating with the C2 server. It retrieves commands from "/api/hsocketNext" and sends execution results back to "/api/hsocketResult," allowing attackers to execute arbitrary commands and maintain long-term access.

The introduction of StoatWaffle signifies an evolution in WaterPlum's tactics, focusing on developer ecosystems and trusted tools like VSCode. By embedding malicious configurations within seemingly legitimate repositories, attackers effectively bypass traditional security awareness.

This campaign highlights the increasing risk of supply chain attacks in development workflows, particularly in high-value sectors like blockchain, where trust in shared code repositories is critical.

Based on reporting by GBHackers.