Activity timeline
WageMole appears in 18 tracked threats between and ; the busiest month was 2026-07 with 7 reports.
ATT&CK techniques observed
- T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 17 of 18 tracked threats
- T1005 Data from Local System — Collectionobserved in 14 of 18 tracked threats
- T1082 System Information Discovery — Discoveryobserved in 14 of 18 tracked threats
- T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 12 of 18 tracked threats
- T1555 Credentials from Password Stores — Credential Accessobserved in 11 of 18 tracked threats
- T1083 File and Directory Discovery — Discoveryobserved in 10 of 18 tracked threats
- T1105 Ingress Tool Transfer — Command and Controlobserved in 9 of 18 tracked threats
- T1140 Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion)observed in 9 of 18 tracked threats
- T1195 Supply Chain Compromise — Initial Accessobserved in 9 of 18 tracked threats
- T1497 Virtualization/Sandbox Evasion — Stealth (formerly Defense Evasion)observed in 9 of 18 tracked threats
- T1657 Financial Theft — Impactobserved in 9 of 18 tracked threats
- T1059 Command and Scripting Interpreter — Executionobserved in 8 of 18 tracked threats
- T1059.007 JavaScript — Executionobserved in 8 of 18 tracked threats
- T1071 Application Layer Protocol — Command and Controlobserved in 8 of 18 tracked threats
- T1071.001 Web Protocols — Command and Controlobserved in 8 of 18 tracked threats
Tracked threats
- ChainDrop npm Worm and PolinRider DPRK-Linked Operation Use Blockchain C2 to Steal Cloud and CI/CD CredentialsHIGH
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain PackagesHIGH
- North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle MalwareHIGH
- Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script DetectionHIGH
- Joyfill npm Supply-Chain Compromise: @joyfill/components and @joyfill/layouts Ship Obfuscated Worm-Like RAT and Credential StealerCRITICAL
- GolangGhost/PylangGhost RAT Targets Web3 Job Seekers to Steal Chrome Credentials and MetaMask Data (Famous Chollima / ClickFake Interview)HIGH
- ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster)HIGH
- OtterCandy (js.ottercandy) Node.js RAT/Stealer — WaterPlum's Polymarket-Themed ClickFake Interview Campaign Leaks Its Own Operator CredentialsHIGH
- North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in Open-Source PackagesHIGH
- PolinRider: North Korea-Linked Supply Chain Campaign Expands Across npm, Packagist, Go Modules, and Chrome ExtensionsCRITICAL
- PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer)HIGH
- AhnLab ASEC April 2026 APT Group Trend Report: State-Sponsored Espionage Campaigns (CVE-2026-32202, CVE-2025-20333/20362, CVE-2021-26855)HIGH
- Famous Chollima (DPRK) Compromises Packagist Package roberts/leads dev Branch — tailwind.js Node.js Loader Uses TRON/Aptos/BNB Blockchain Dead-Drop C2 (EtherHiding-style)HIGH
- Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret — .pyd/.so Binary Evasion of Script-Based Detections (DPRK Contagious Interview)HIGH
- Void Dokkaebi (Contagious Interview / Famous Chollima) — DPRK Fake Job Interview Campaign Delivering BeaverTail, InvisibleFerret, OtterCookie & GolangGhost via Trojanized Code RepositoriesHIGH
- DPRK Contagious Interview Supply Chain RAT Campaign via npm, PyPI, and Multi-Ecosystem Package PoisoningHIGH
- Contagious Interview: DPRK Campaign Delivers OtterCookie and FlexibleFerret Backdoors via Fake Developer Job InterviewsHIGH
- Famous Chollima (DPRK) npm Supply Chain — Pastebin Text Steganography Dead-Drop Resolver, 17 Malicious Packages, Vercel C2 InfrastructureHIGH