INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

WeaselBiscuit Stealer Spreads via 13 npm Packages to Chrome

| 2026-09-17 15:28 CRITICAL HIGH SUPPLY CHAIN MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
A cluster of 13 npm packages was found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit, which exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and OtterCookie. The attack works by triggering an npm import that pulls the main malware from a dead drop and executes it directly in memory, resolving its command-and-control configuration from a separate URL to harvest Chrome extension storage across Windows, macOS, and Linux. As of September 18, 2026, no definitive evidence has been found to conclusively attribute WeaselBiscuit to North Korea; however, similarities with DPRK-associated malware have been noted. The affected regions include TARGET_REGION (country) [TARGET_REGION] and TARGET_REGION (region) [TARGET_REGION], but the exact number of targeted countries is unknown at this time.
Technical Mitigations AI-generated
• @biz44/id10-client, CVE-2023-28311 • process-mite, technique to detect: "--remote-debug" • @biz44/id95-client, indicator to block or hunt for: "node-nvm-ssh"
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 27 IoCs Create Free Account
ap•••••.com
ph•••••.zip
cr•••••.sh
st•••••.com
lo•••••.js
ch•••••.exe
157.240.•••.•••
157.240.•••.•••
98.136.•••.•••
212.82.•••.•••
hxxp://••••••••••••••••••••
cde9a0••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
39a6ce••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
cf4724••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
a0e9f5••••••••••••••••••••••••••
8a7891••••••••••••••••••••••••••
f34d5f••••••••••••••••••••••••••
57c8ed••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Contagious InterviewContagious Interview InvisibleFerretInvisibleFerretBeaverTailBeaverTail
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DPRK DPRK BENELUX BENELUX cryptocurrencycryptocurrency technologytechnology
Incident Timeline
‎at least late 2022
Threat actors used spyware to target DuckDuckGo since at least late 2022.
‎December 2024
NTT Security Holdings publicly documented the malware in December 2024.
organisation NTT Security Holdings
The malware was first publicly documented by NTT Security Holdings in December 2024.
‎October 2025
Threat actors utilizing the npm package "node-nvm-ssh" exhibited characteristics of both BeaverTail and OtterCookie, raising concerns about potential spyware or retrieval information compromise.
malware BeaverTail
In October 2025, Cisco Talos said it identified an npm package named "node-nvm-ssh" that "had characteristics of BeaverTail and of OtterCookie, blurring the distinction between the two."
‎November 2025
Threat actors used Npoint.io, an online JSON storage service flagged by NVISO in November 2025, to store retrieval information.
target_region Korea, Democratic People's Republic of
Other tradecraft signals that point to North Korea are as follows - The use of Npoint.io, a lightweight online JSON storage service – an aspect that was flagged by NVISO in November 2025 in connection with Contagious Interview The use of nested public-IP and geolocation lookup via api.ipify.org and ip-api.com Similarities in C2 architecture that overlap with OtterCookie The use of a…
organisation NVISO
Other tradecraft signals that point to North Korea are as follows - The use of Npoint.io, a lightweight online JSON storage service – an aspect that was flagged by NVISO in November 2025 in connection with Contagious Interview The use of nested public-IP and geolocation lookup via api.ipify.org and ip-api.com Similarities in C2 architecture that overlap with OtterCookie The use of a…
‎september 15th 2026
Threat actors used a zero-day exploit to compromise DuckDuckGo's systems, specifically targeting the search engine's retrieval information.
‎2026/09/17
Threat actors used WeaselBiscuit, a stripped-down JavaScript stealer malware, to target software developers, IT professionals, and cryptocurrency users via 13 npm packages.
organisation Spyware/Retrieval Information
Spyware/Retrieval Information | DuckDuckGo.
threat_actor Contagious Interview
" OpenSourceMalware has emphasized that despite the "meaningful overlap with DPRK-associated Contagious Interview tooling," there is no definitive evidence in terms of operator infrastructure, victimology, campaign metadata, or signing material to conclusively attribute it to North Korea.
…aft signals that point to North Korea are as follows - The use of Npoint.io, a lightweight online JSON storage service – an aspect that was flagged by NVISO in November 2025 in connection with Contagious Interview The use of nested public-IP and geolocation lookup via api.ipify.org and ip-api.com Similarities in C2 architecture that overlap with OtterCookie The use of a numerical cam…
" BeaverTail is the name assigned to a cross-platform information-stealing malware and downloader operated by North Korean threat actors behind Contagious Interview to target software developers, IT professionals, and cryptocurrency users.
Contagious Interview campaign: BeaverTail and OtterCookie .
organisation The Hacker News
…/id95-client @biz44/id99-client @biz44/process-runtime-utils @biz44/runtime-utils engin1 id79-client process-lhpm process-mite process-tailwind "It's a stripped down stealer that borrows several functions from DPRK's BeaverTail and OtterCookie, but is much smaller and self-contained," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
organisation OtterCookie
Contagious Interview campaign: BeaverTail and OtterCookie .
organisation OtterCookie The
…SO in November 2025 in connection with Contagious Interview The use of nested public-IP and geolocation lookup via api.ipify.org and ip-api.com Similarities in C2 architecture that overlap with OtterCookie The use of a numerical campaign ID (10, 12, 44, 79, 95, 99) to tag each install, mirroring that of PolinRider If WeaselBiscuit does turn out to be the latest addition to DPRK's mal…
organisation the Democratic People's Republic of Korea's
The new malware family, per OpenSourceMalware , exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK)
organisation engin1
…s are below - @biz44/id10-client @biz44/id12-client @biz44/id44-client @biz44/id79-client @biz44/id95-client @biz44/id99-client @biz44/process-runtime-utils @biz44/runtime-utils engin1 id79-client process-lhpm process-mite process-tailwind "It's a stripped down stealer that borrows several functions from DPRK's BeaverTail and OtterCookie, but is much smaller and…
organisation id79
The names of the packages are below - @biz44/id10-client @biz44/id12-client @biz44/id44-client @biz44/id79-client @biz44/id95-client @biz44/id99-client @biz44/process-runtime-utils @biz44/runtime-utils engin1 id79-client process-lhpm process-mite process-tailwind "It's a stripped down stealer that borrows several functions from DPRK's BeaverTail and OtterCookie,…
organisation Npoint
Instead, it's triggered via an npm import, which causes the loader ("loader.js") to pull the main malware from an Npoint dead drop and execute it directly in memory.
infrastructure Windows
Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux.
Based on operator commands received from the C2 server ("103.170.217[.]184:8787"), it can also log clipboard contents and keystrokes on Windows machines.
infrastructure Macos
Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux.
infrastructure Linux
Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux.
organisation WeaselBiscuit
 Ravie Lakshmanan  Sep 18, 2026 Malware / Web Security Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit .
‎Sep 18, 2026
Threat actors used a phishing email campaign to trick users into installing spyware on their devices, targeting individuals who searched for sensitive information on DuckDuckGo.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux.
Based on operator commands received from the C2 server ("103.170.217[.]184:8787"), it can also log clipboard contents and keystrokes on Windows machines.
Metrics
infrastructure
‎Macos
Affected Product
Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux.
Metrics
infrastructure
‎Linux
Affected Product
Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux.
Intelligence Sources
The Hacker News 2026-09-18
AlienVault OTX 2026-09-17