OtterCookie Malware — Analysis, Campaigns & Threat Activity

Overview

OtterCookie is a malware family attributed to North Korean threat actors. Recent campaigns show updated OtterCookie variants being spread through popular developer ecosystems, including npm packages and hosting platforms like GitHub and Vercel, highlighting a cross-platform supply-chain approach and expanding distribution; the activity underscores the threat actors' evolving infrastructure to disseminate credential/cookie-stealing malware.

Related Threat Clusters

• Void Dokkaebi's Malware Campaign Exploits Developer Repositories via Fake Job Interviews

  Void Dokkaebi, a North Korean threat actor, has escalated its malware distribution tactics by using fake job interviews to compromise software developers. This campaign, known as the 'Contagious Interview,' targets…

  22 articles · Updated April 22, 2026
• HexagonalRodent Targets Web3 Developers with Social Engineering Attacks

  The Lazarus Group's HexagonalRodent faction is targeting Web3 developers using social engineering tactics, including fake job offers for high-paying remote positions and recruitment for well-known projects. These…

  2 articles · Updated April 25, 2026
• North Korean Hackers Use SVG Steganography in Job Scam Malware Campaign

  DPRK-aligned hackers have launched a campaign known as Contagious Interview, utilizing steganography to hide malware within SVG flag images. This malware targets developers through fake job postings and coding…

  2 articles · Updated July 19, 2026
• WaterPlum's StoatWaffle Malware Targets VSCode Users

  The North Korea-linked hacking group WaterPlum has launched a new malware strain called StoatWaffle, targeting developers through compromised Visual Studio Code (VSCode) repositories. This malware is part of an ongoing…

  4 articles · Updated March 19, 2026
• North Korean Hackers Use npm, GitHub, and Vercel to Distribute OtterCookie Malware

  North Korean hackers are exploiting vulnerabilities in npm, GitHub, and Vercel to distribute OtterCookie malware. This malware targets software developers and is designed to steal sensitive information. The attack…

  5 articles · Updated November 27, 2025
• North Korea's Contagious Interview Campaign Uses JSON for Malware Distribution

  North Korean threat actors are utilizing JSON storage services to distribute malware through the Contagious Interview campaign, which has been active since 2023. They impersonate hiring professionals to lure developers…

  2 articles · Updated November 17, 2025
• North Korea's Contagious Interview Campaign Uses JSON for Malware Distribution

  North Korean threat actors are utilizing JSON storage services to distribute malware as part of the ongoing Contagious Interview campaign, which has been active since 2023. The campaign involves impersonating hiring…

  2 articles · Updated November 17, 2025

Recent Intelligence Reports

• Contagious Interview Malware Svg Steganography — www.elastic.co · July 20, 2026
• Fake Coding Tests Deliver OtterCookie — Thehackernews · July 17, 2026
• Slow Fog: HexagonalRodent is targeting Web3 developers with attacks — Chaincatcher · April 25, 2026
• SlowMist Warns of Lazarus Group's Social Engineering Attacks on Web3 Developers — Kucoin · April 24, 2026
• Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories — Trendmicro · April 22, 2026
• WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack — Gbhackers · March 19, 2026
• North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware — Thehackernews · November 28, 2025
• North Korean Hackers Abuse npm, GitHub, and Vercel to Spread OtterCookie Malware — Gbhackers · November 27, 2025

Related Entities