# Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script Detection

> North Korea-linked Void Dokkaebi (aka Famous Chollima / Contagious Interview) has upgraded its InvisibleFerret information-stealer and BeaverTail loader from plaintext Python/JavaScript into Cython-compiled native binaries (.pyd on Windows, .so on macOS), defeating script-pattern detection. The malware is delivered via fake recruiter/job-interview lures that induce developers to clone and run malicious Git repositories, then harvests browser credentials, clipboard data, keystrokes, and cryptocurrency wallet assets (MetaMask, Coinbase Wallet, Phantom).

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2145
- **ID:** TL-2026-2145
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Void Dokkaebi, a North Korea-aligned intrusion set tracked elsewhere as Famous Chollima, Contagious Interview, Wagemole, CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, UNC5342, and (as of June 2026) HexagonalRodent, runs a long-running employment-fraud and developer-targeting operation assessed active since at least 2018. The group's core playbook is to impersonate recruiters from cryptocurrency and AI companies on professional networking platforms, walk a developer through a fabricated interview process, and instruct them to clone a GitHub/GitLab/Bitbucket repository and run it as a 'technical assessment.' A companion April 2026 Trend Micro report documented the scale of this repo-based distribution model: more than 750 infected public repositories, over 500 malicious VS Code task configurations, and 101 cases of a custom batch script tampering with commits to conceal the injected code.

The malware delivered through this lure is a two-part toolkit. BeaverTail is a JavaScript-based loader/stealer that has evolved from a simple downloader into a multi-function tool with four variants: gjs (data theft and component download), njs (backdoor functions), zjs (wallet seed-phrase and private-key theft), and cjs (installs trojanized cryptocurrency wallet browser extensions). InvisibleFerret is the Python-based second-stage stealer/backdoor, itself split into modules: mod (initial C2 connection and payload download), pad (backdoor access and system enumeration), brw (browser credential and payment-card theft), and, on macOS only, mc (trojanized wallet-extension installation).

The upgrade documented in Trend Micro's May 25, 2026 analysis (the basis for this threat) is a defense-evasion change to how InvisibleFerret and BeaverTail's payload modules are shipped: rather than distributing readable Python/JavaScript source, the group now compiles the stealer modules with Cython into native Python extension binaries — .pyd on Windows and .so on macOS — dropped alongside small execution scripts (.mod, pad0, brw0, mc0) inside the project's .vscode directory. Because these binaries load into the Python interpreter as native extension modules rather than running as visible script text, security tools that pattern-match on Python/JavaScript source code do not flag them, even though the underlying stealer logic (browser credential theft, clipboard monitoring, keystroke logging, wallet targeting) is unchanged. Analysts can still recover module initialization functions and embedded file-system paths from the compiled binaries, including a build artifact path (/Users/administrator/Pictures/Work/py_module_work/) left over from the actor's development environment. Additional obfuscation layers include Base64 fragment shuffling at startup, 4-byte XOR-encrypted strings, zlib-compressed segments containing the original Python logic, and C2 IP addresses that are split, byte-swapped, and Base64-encoded before being embedded or passed at runtime.

On the network side, one secondary source (cybersecuritynews.com) reports a specific C2 IP, 45.59.160.199, reached over HTTP at path patterns /clw/{sType} (Windows) and /clw1/{sType} (macOS), plus use of the legitimate ip-api.com geolocation service to fingerprint victim location. A second independent secondary source covering the same Trend Micro research (gbhackers.com) instead states that C2 details are NOT fully embedded in the compiled binaries but are passed dynamically via command-line arguments from the execution script, which it flags as a deliberate complication for static analysis. Both statements can be true simultaneously (an IP observed in one deployment, with the mechanism generally supporting runtime override), but the primary Trend Micro report could not be directly retrieved (HTTP 403) to resolve the discrepancy, so the 45.59.160.199 indicator should be treated as medium-confidence, single-secondary-source-attributed rather than confirmed against the primary research.

Separately, on macOS, the group has been reported to force a Chrome version downgrade in order to bypass current browser extension security controls before installing trojanized MetaMask, Coinbase Wallet, and Phantom extensions; Brave Browser is also targeted. The broader Void Dokkaebi/Contagious Interview cluster has a documented history of front companies used to lend the recruiter lure legitimacy (e.g., BlockNovas LLC, seized by the FBI on April 23, 2025, alongside Angeloper Agency and SoftGlide LLC), and a June 2026 Proofpoint-sourced report ties related developer-recruitment phishing to nearly 100 targeted organizations across finance, cryptocurrency, education, and technology sectors, delivering cross-platform (Windows/macOS/Linux) malware via actor-controlled GitHub repositories linked from phishing emails.

## MITRE ATT&CK

- T1585.001 Social Media Accounts
- T1566.003 Spearphishing via Service
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.006 Python
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1555.003 Credentials from Web Browsers
- T1614 System Location Discovery
- T1056.001 Keylogging
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1657 Financial Theft

## Sources

- [Analyzing Void Dokkaebi's Cython-Compiled InvisibleFerret Malware](https://www.trendmicro.com/en_us/research/26/e/analyzing-void-dokkaebi-invisibleferret-malware.html)
- [InvisibleFerret Malware Now Ships as .pyd and .so Files to Evade Script Detection](https://cybersecuritynews.com/invisibleferret-malware-now-ships-as-pyd/)
- [InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection](https://gbhackers.com/invisibleferret-malware-uses-pyd/)
- [Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories](https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html)
- [Void Dokkaebi Spreads Malware via Fake Git Repos](https://socprime.com/active-threats/void-dokkaebi-analysis/)
- [North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels](https://thehackernews.com/2026/06/north-korean-hackers-are-turning.html)
- [Famous Chollima Adversary Profile](https://www.crowdstrike.com/en-us/adversaries/famous-chollima/)
- [North Korean Hackers Spread Malware via Fake Crypto Firms and Job Interview Lures](https://thehackernews.com/2025/04/north-korean-hackers-spread-malware-via.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2145