# OtterCandy (js.ottercandy) Node.js RAT/Stealer — WaterPlum's Polymarket-Themed ClickFake Interview Campaign Leaks Its Own Operator Credentials

> OtterCandy (js.ottercandy) is a cross-platform Node.js RAT and cryptocurrency/credential stealer deployed by the North Korea-linked WaterPlum (Famous Chollima/PurpleBravo) actor as part of the ongoing Contagious Interview / ClickFake Interview social-engineering campaign. A 2026-07-12 OX Security analysis of a Polymarket-themed malicious npm package (polymarket-kit, C2 svganchordev[.]net) built on the same tradecraft found the operators had inadvertently embedded their own cleartext SSH private keys and GitLab credentials inside the published package.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1441
- **ID:** TL-2026-1441
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OtterCandy is a Node.js-based remote access trojan and information stealer first uploaded to VirusTotal in February 2025 (initially misclassified as OtterCookie) and distributed in the wild from July 2025 onward across Windows, macOS, and Linux — a platform-unification step up from WaterPlum's earlier per-OS toolset (GolangGhost for Windows, FrostyFerret for macOS). The malware is functionally a fusion of two earlier WaterPlum families, RATatouille and OtterCookie, and communicates with its C2 over the Socket.IO real-time protocol, giving operators arbitrary remote command execution. Version 1 exfiltrated a username plus partial Chromium browser-extension data from four wallet extensions; version 2 (deployed August 2025) added a unique client_id per-victim tracking field, expanded targeting to seven browser wallet extensions, moved to full Chromium user-data-directory exfiltration, and introduced an anti-forensic 'ss_del' command that deletes the persistence registry keys and files belonging to OtterCandy's companion persistence implant, DiggingBeaver, to frustrate incident response. OtterCandy also self-resurrects by re-registering a Node.js SIGINT handler so that attempts to Ctrl-C or kill the process relaunch it.

OtterCandy is delivered through WaterPlum's ClickFake Interview operation, a sub-cluster of the broader, DPRK-attributed Contagious Interview campaign (active since at least December 2022, tracked jointly as CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi, and WaterPlum; MITRE ATT&CK Group G1052). Operators pose as recruiters (including via three known front companies — BlockNovas LLC, Angeloper Agency, and SoftGlide LLC) on LinkedIn, Telegram, and email, luring blockchain/crypto developers and job seekers into fake 'technical interview' or coding-assessment flows. Victims are pushed through ClickFix-style pages that instruct them to copy/paste and execute attacker-supplied shell commands, or to install a trojanized 'interview' application, ultimately dropping BeaverTail (JavaScript npm-hosted stealer), InvisibleFerret (Python backdoor), and/or OtterCandy, frequently staged via malicious npm loaders XORIndex and HexEval.

The specific hunt trigger for this record is a parallel, thematically identical operation surfaced by OX Security on 2026-07-12: a malicious npm package family (polymarket-kit and related polymarket-*/clob-*/kelly-* named packages) impersonating the Polymarket prediction-market platform's trading tooling to target high-value cryptocurrency users. After obfuscated multi-stage dropper execution, the payload establishes a WebSocket connection to C2 domain svganchordev[.]net (masquerading as an image-hosting site), giving operators an 'exec' primitive for arbitrary remote command execution — functionally a RAT consistent with WaterPlum/OtterCandy-style tradecraft. The malware enumerates and decrypts local browser-extension wallet stores (MetaMask, Phantom, TronLink, Coinbase Wallet, OKX Wallet, Trust Wallet, Rabby Wallet) and desktop wallets (Exodus, Guarda, Electrum, Atomic Wallet), and separately harvests Google Cloud, AWS, and Azure credentials/configuration files, uploading everything to the C2 over the same WebSocket channel. Researchers discovered the operators had left their own operational-security failure baked into the published package: a cleartext OpenSSH ed25519 private key (public key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtHcyfcCaE2XEiBHlMEjP6VjIz3Ck8gaEDE7Q+gwN4w) tied to account testm@DESKTOP-PO28IS1, plus additional GitLab private SSH keys, all shipped in cleartext inside the npm package contents — exposing attacker-controlled infrastructure to defenders and researchers.

The broader Polymarket-impersonation npm threat landscape in 2026 includes multiple parallel, possibly overlapping operations: a hijacked verified GitHub organization (dev-protocol) used to distribute typosquatted Polymarket trading-bot packages that steal wallet private keys, exfiltrate files, and open SSH backdoors; a ten-account, 30-package fake-arbitrage-bot campaign whose second-stage 2,787–2,887-line JavaScript infostealer reads crypto wallet vaults, browser credentials, SSH keys, AWS credentials, npm tokens, Docker configs, shell history, and password-manager databases; and a nine-package, single-account (polymarketdev) campaign that displays a fake wallet-onboarding prompt and POSTs pasted private keys in cleartext to a Cloudflare Worker endpoint. These campaigns collectively demonstrate that Polymarket-branded crypto tooling has become a preferred lure surface for both DPRK state-linked operators and opportunistic criminal actors targeting developers and crypto power-users through the npm supply chain.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1583.001 Domains
- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1588.001 Malware
- T1608.001 Upload Malware
- T1566.003 Spearphishing via Service
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1053 Scheduled Task/Job
- T1546.004 Unix Shell Configuration Modification
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1070.004 File Deletion
- T1070.009 Clear Persistence
- T1552 Unsecured Credentials
- T1555.003 Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1187 Forced Authentication
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1090 Proxy
- T1573.001 Symmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials](https://www.ox.security/blog/malware-slop-crypto-stealer-impersonating-polymarket-exposes-its-own-credentials/)
- [OtterCandy, malware used by WaterPlum (Malpedia)](https://malpedia.caad.fkie.fraunhofer.de/library/3fa4a406-c8a4-4c5a-b23b-436405d16fec/)
- [ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware](https://gbhackers.com/clickfake-interview-campaign/)
- [North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware](https://thehackernews.com/2025/10/north-korean-hackers-combine-beavertail.html)
- [North Korea's WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module](https://securityonline.info/north-koreas-waterplum-apt-deploys-node-js-ottercandy-rat-for-crypto-theft-with-anti-forensic-module/)
- [OtterCandy, malware used by WaterPlum - Live Threat Intelligence (OffSeq Threat Radar)](https://radar.offseq.com/threat/ottercandy-malware-used-by-waterplum-6705a1c3)
- [Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121, Group G1052 (MITRE ATT&CK)](https://attack.mitre.org/groups/G1052/)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys](https://www.stepsecurity.io/blog/malicious-polymarket-bot-hides-in-hijacked-dev-protocol-github-org-and-steals-wallet-keys)
- [The Polymarket Trap: A Fake Arbitrage Bot, Ten npm Accounts, and Four Ways to Deliver an Infostealer](https://safedep.io/defi-infostealer-fake-arbitrage-bot-npm/)
- [A Patient Trojan Dropper: polymarket-stake-math Steals Wallet Keys, Browser Sessions, and Telegram from Crypto Developers](https://panther.com/blog/a-patient-trojan-dropper-polymarket-stake-math-steals-wallet-keys-browser-sessions-and-telegram-from-crypto-developers)
- [Contagious Interview gets an upgrade for 2026 - A comprehensive analysis](https://opensourcemalware.com/blog/contagious-interview-comprehensive)
- [New wave of 'fake interviews' use 35 npm packages to spread malware](https://www.bleepingcomputer.com/news/security/new-wave-of-fake-interviews-use-35-npm-packages-to-spread-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1441