Back Gbhackers

WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

Gbhackers •Mayura Kathir • March 19, 2026

A North Korea-linked threat group known as WaterPlum has introduced a new malware strain called “StoatWaffle” as part of its ongoing Contagious Interview campaign. The activity has been attributed to Team 8, a subgroup within WaterPlum also tracked as the Moralis or Modilus cluster. This team was previously associated with the OtterCookie malware, but since […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WaterPlum's StoatWaffle Malware Targets VSCode Users The North Korea-linked hacking group WaterPlum has launched a new malware strain called StoatWaffle, targeting developers through compromised Visual Studio Code (VSCode) repositories. This malware is part of an ongoing campaign named 'Contagious Interview,' which lures victims with fake job offers. The attack vector involves disguising the malware as legitimate blockchain development projects, allowing it to infiltrate developer machines without detection. The specific scope of the impact remains unclear, but the campaign has been linked to a subgroup known as Team 8, previously associated with the OtterCookie malware. As of now, there are no reported CVEs or specific numbers of affected systems. Security professionals are urged to remain vigilant and monitor for signs of compromise. 4 sources 57

Extracted Entities

WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

The full story

Extracted Entities

APT Groups (4)

Attack Types (2)

Campaigns (1)

Countries (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)