OtterCandy (js.ottercandy) Node.js RAT/Stealer — WaterPlum's Polymarket-Themed ClickFake Interview Campaign Leaks Its Own Operator Credentials

OtterCandy (js.ottercandy) Node.js RAT/Stealer (TL-2026-1441), also tracked as js.ottercandy, is a high-severity malware campaign, first published 2026-07-17. It is attributed to WageMole (North Korea) with high confidence, affects npm / Node.js ecosystem polymarket-kit and related, maps to 37 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-1441

Threat ID
TL-2026-1441
Also known as
js.ottercandy, OtterCandy RAT, Malware-Slop Polymarket Stealer, polymarket-kit
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-17
Last reviewed
2026-07-17
Attribution
WageMole
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
cryptocurrency, finance, technology, software development, blockchain defi
Target regions
Global, germany, united kingdom, france, netherlands, sweden, switzerland, japan, North America
Detection rules
9
Indicators of compromise
24

Malware and tooling in OtterCandy (js.ottercandy) Node.js RAT/Stealer

Malware and tooling: BeaverTail - S1246, DiggingBeaver, FrostyFerret, GolangGhost (OS X), InvisibleFerret - S1245, OtterCandy, OtterCookie, HexEval Loader, XORIndex Loader

OtterCandy (js.ottercandy) is a cross-platform Node.js RAT and cryptocurrency/credential stealer deployed by the North Korea-linked WaterPlum (Famous Chollima/PurpleBravo) actor as part of the ongoing Contagious Interview / ClickFake Interview social-engineering campaign. A 2026-07-12 OX Security analysis of a Polymarket-themed malicious npm package (polymarket-kit, C2 svganchordev[.]net) built on the same tradecraft found the operators had inadvertently embedded their own cleartext SSH private keys and GitLab credentials inside the published package.

How OtterCandy (js.ottercandy) Node.js RAT/Stealer works

OtterCandy is a Node.js-based remote access trojan and information stealer first uploaded to VirusTotal in February 2025 (initially misclassified as OtterCookie) and distributed in the wild from July 2025 onward across Windows, macOS, and Linux — a platform-unification step up from WaterPlum's earlier per-OS toolset (GolangGhost for Windows, FrostyFerret for macOS). The malware is functionally a fusion of two earlier WaterPlum families, RATatouille and OtterCookie, and communicates with its C2 over the Socket.IO real-time protocol, giving operators arbitrary remote command execution. Version 1 exfiltrated a username plus partial Chromium browser-extension data from four wallet extensions; version 2 (deployed August 2025) added a unique client_id per-victim tracking field, expanded targeting to seven browser wallet extensions, moved to full Chromium user-data-directory exfiltration, and introduced an anti-forensic 'ss_del' command that deletes the persistence registry keys and files belonging to OtterCandy's companion persistence implant, DiggingBeaver, to frustrate incident response. OtterCandy also self-resurrects by re-registering a Node.js SIGINT handler so that attempts to Ctrl-C or kill the process relaunch it.

OtterCandy is delivered through WaterPlum's ClickFake Interview operation, a sub-cluster of the broader, DPRK-attributed Contagious Interview campaign (active since at least December 2022, tracked jointly as CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi, and WaterPlum; MITRE ATT&CK Group G1052). Operators pose as recruiters (including via three known front companies — BlockNovas LLC, Angeloper Agency, and SoftGlide LLC) on LinkedIn, Telegram, and email, luring blockchain/crypto developers and job seekers into fake 'technical interview' or coding-assessment flows. Victims are pushed through ClickFix-style pages that instruct them to copy/paste and execute attacker-supplied shell commands, or to install a trojanized 'interview' application, ultimately dropping BeaverTail (JavaScript npm-hosted stealer), InvisibleFerret (Python backdoor), and/or OtterCandy, frequently staged via malicious npm loaders XORIndex and HexEval.

The specific hunt trigger for this record is a parallel, thematically identical operation surfaced by OX Security on 2026-07-12: a malicious npm package family (polymarket-kit and related polymarket-*/clob-*/kelly-* named packages) impersonating the Polymarket prediction-market platform's trading tooling to target high-value cryptocurrency users. After obfuscated multi-stage dropper execution, the payload establishes a WebSocket connection to C2 domain svganchordev[.]net (masquerading as an image-hosting site), giving operators an 'exec' primitive for arbitrary remote command execution — functionally a RAT consistent with WaterPlum/OtterCandy-style tradecraft. The malware enumerates and decrypts local browser-extension wallet stores (MetaMask, Phantom, TronLink, Coinbase Wallet, OKX Wallet, Trust Wallet, Rabby Wallet) and desktop wallets (Exodus, Guarda, Electrum, Atomic Wallet), and separately harvests Google Cloud, AWS, and Azure credentials/configuration files, uploading everything to the C2 over the same WebSocket channel. Researchers discovered the operators had left their own operational-security failure baked into the published package: a cleartext OpenSSH ed25519 private key (public key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtHcyfcCaE2XEiBHlMEjP6VjIz3Ck8gaEDE7Q+gwN4w) tied to account testm@DESKTOP-PO28IS1, plus additional GitLab private SSH keys, all shipped in cleartext inside the npm package contents — exposing attacker-controlled infrastructure to defenders and researchers.

The broader Polymarket-impersonation npm threat landscape in 2026 includes multiple parallel, possibly overlapping operations: a hijacked verified GitHub organization (dev-protocol) used to distribute typosquatted Polymarket trading-bot packages that steal wallet private keys, exfiltrate files, and open SSH backdoors; a ten-account, 30-package fake-arbitrage-bot campaign whose second-stage 2,787–2,887-line JavaScript infostealer reads crypto wallet vaults, browser credentials, SSH keys, AWS credentials, npm tokens, Docker configs, shell history, and password-manager databases; and a nine-package, single-account (polymarketdev) campaign that displays a fake wallet-onboarding prompt and POSTs pasted private keys in cleartext to a Cloudflare Worker endpoint. These campaigns collectively demonstrate that Polymarket-branded crypto tooling has become a preferred lure surface for both DPRK state-linked operators and opportunistic criminal actors targeting developers and crypto power-users through the npm supply chain.

MITRE ATT&CK techniques used in TL-2026-1441

Collection

T1005 Data from Local System; T1074 Data Staged

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1070.009 Clear Persistence; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053 Scheduled Task/Job; T1546.004 Unix Shell Configuration Modification; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.004 Unix Shell; T1059.007 JavaScript; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Credential Access

T1187 Forced Authentication; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555.003 Credentials from Web Browsers

Initial Access

T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1585.001 Social Media Accounts; T1587.001 Malware; T1588.001 Malware; T1608.001 Upload Malware

Reconnaissance

T1589 Gather Victim Identity Information; T1593 Search Open Websites/Domains

Impact

T1657 Financial Theft

Affected products and versions in OtterCandy (js.ottercandy) Node.js RAT/Stealer

  • npm / Node.js ecosystem — polymarket-kit and related polymarket-*/clob-*/kelly-* packages
    Vulnerable versions: all published versions
    Fixed in: package removed from registry; no fixed version
  • N/A (cross-platform malware) — OtterCandy RAT/stealer
    Vulnerable versions: v1 (2025-07); v2 (2025-08, current)
    Fixed in: N/A

Remediation for OtterCandy (js.ottercandy) Node.js RAT/Stealer

Immediate actions

  • Uninstall polymarket-kit and any polymarket-*/clob-*/kelly-* prefixed npm packages from all developer machines and CI/CD pipelines
  • Block C2 domain svganchordev[.]net at DNS/perimeter/proxy
  • Rotate all browser-extension crypto wallet seed phrases/private keys on any host that had the package installed
  • Rotate cloud credentials (AWS, GCP, Azure) and SSH keys stored on affected developer workstations
  • Revoke/rotate the exposed attacker SSH key pair (ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtHcyfcCaE2XEiBHlMEjP6VjIz3Ck8gaEDE7Q+gwN4w) and associated GitLab keys wherever reused for tracking/blocking
  • Hunt for Node.js processes maintaining persistent Socket.IO/WebSocket connections to unrecognized external hosts

Workarounds

  • Use `npm audit`/registry scanning gates that block install of newly-published, low-download-count packages impersonating known crypto brands

Longer-term hardening

  • Enforce npm package-provenance/allowlisting and typosquat detection in CI pipelines (e.g., Socket.dev, StepSecurity, OX Security scanning)
  • Mandate hardware wallets or OS-keychain-backed signing for developer crypto wallet usage rather than browser-extension hot wallets
  • Train developers and recruiting-adjacent staff to recognize ClickFake/ClickFix fake-interview social engineering
  • Deploy EDR detection for Node.js self-resurrection via process.on('SIGINT') patterns and unsigned Socket.IO client libraries
  • Segment/limit cloud credential exposure on developer endpoints (short-lived tokens, least privilege)

Weaknesses (CWE) in OtterCandy (js.ottercandy) Node.js RAT/Stealer

CWE-798, CWE-522, CWE-506

Timeline of OtterCandy (js.ottercandy) Node.js RAT/Stealer

  • Contagious Interview campaign (DPRK-attributed, MITRE Group G1052) begins operating, targeting developers via fake job-interview social engineering.
  • First OtterCandy sample uploaded to VirusTotal, initially misclassified as OtterCookie.
  • OtterCandy v1 distribution begins in the wild across Windows, macOS, and Linux via the ClickFake Interview sub-campaign.
  • OtterCandy v2 released: adds client_id victim tracking, expands wallet-extension targeting from four to seven browser extensions, moves to full Chromium data exfiltration, and introduces the ss_del anti-forensic persistence-deletion command.
  • NTT Security Japan / researchers publish detailed technical analysis of OtterCandy combining BeaverTail and OtterCookie functionality; widely reported by The Hacker News and Security Online.
  • OpenSourceMalware.com publishes a comprehensive analysis of the Contagious Interview campaign's 2026 upgrade.
  • Microsoft Security Blog publishes advisory on Contagious Interview malware delivered through fake developer job interviews.
  • Wave of Polymarket-themed malicious npm packages (e.g., polymarket-stake-math) begins targeting crypto developers, stealing wallet keys, browser sessions, and Telegram data.
  • Ten-account, 30-package fake Polymarket arbitrage-bot npm campaign discovered, delivering a large JavaScript infostealer targeting wallets, cloud creds, and developer secrets.
  • Verified dev-protocol GitHub organization hijacked and flooded with Polymarket-themed scam repos distributing typosquatted wallet-stealing npm packages.
  • OX Security discovers and publishes analysis of the polymarket-kit malicious npm package, its Socket.IO-adjacent WebSocket RAT/stealer functionality, C2 domain svganchordev[.]net, and the operators' own exposed SSH/GitLab credentials.

Sources cited for OtterCandy (js.ottercandy) Node.js RAT/Stealer

Threats related to OtterCandy (js.ottercandy) Node.js RAT/Stealer

Detection coverage for TL-2026-1441

As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1441 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1441

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats