# Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret Infostealer Campaign

> Trend Micro reports the North Korea-aligned intrusion set Void Dokkaebi (aka Famous Chollima) uses fake job-interview lures against software developers to deploy BeaverTail and InvisibleFerret. InvisibleFerret is now compiled with Cython into .pyd (Windows) and .so (macOS) modules, providing backdoor access, browser credential theft, clipboard monitoring, keylogging (Windows) and cryptocurrency wallet targeting.

- **Published:** 2026-10-20T00:17:17Z
- **Last reviewed:** 2026-10-20T00:17:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3920
- **ID:** TL-2026-3920
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Void Dokkaebi, tracked by others as Famous Chollima, is a North Korea-aligned intrusion set that targets software developers with access to cryptocurrency wallets, signing keys, CI/CD pipelines and production infrastructure. Initial contact is a fake job interview lure. The infection chain starts with BeaverTail, a JavaScript downloader/stealer, which retrieves further BeaverTail variants and finally InvisibleFerret.

Trend Micro (Kazuki Fujisawa, 2026-05-22) documents four BeaverTail variants that appeared from October 2025. BeaverTail (gjs) steals browser and cryptocurrency wallet data and downloads BeaverTail (njs), (zjs) and InvisibleFerret. (njs) is a backdoor with ssh_-prefixed functions that also collects system/network information and geolocates the host via ip-api.com. (zjs) steals wallet data, seed phrases, private keys and passwords. (cjs) downloads and installs trojanized Chrome and Brave extensions, including MetaMask, Coinbase Wallet and Phantom lookalikes. BeaverTail obfuscation combines shuffled arrays of roughly 300 Base64 fragments via an IIFE, random junk-byte prefixes, a 4-byte XOR key for sensitive paths and commands, and split-and-swap encoding of C&C IP addresses before Base64 decoding.

The key evolution is that InvisibleFerret is no longer delivered as readable Python scripts. It is compiled with Cython into native extension modules (.pyd on Windows, .so on macOS) that need a small Python wrapper script (.mod files) to load them. Modules: mod (downloads pad.pyd and brw.pyd on Windows, pad.so on macOS), pad (backdoor with ssh_-prefixed execution functions), brw (browser authentication and credit-card theft) and mc.so (macOS; installs trojanized Chrome/Brave extensions and can downgrade the installed Chrome version; the only module that deletes its execution script). Binaries export PyInit_mod, PyInit_pad and PyInit_brw and retain .pyx/.c source path references and macOS build paths (/Users/administrator/Pictures/Work/py_module_work/build/temp.macosx-10.13-universal2-cpython-312/). Python string constants are Zlib-compressed (CYTHON_COMPRESS_STRINGS). C&C addresses are stored as 16-character XOR-encoded strings (for example 91d840f599206f13 decodes to 45.59.160.199) with ports defined in the binary or passed as runtime arguments. The unchanged deobfuscation logic is a lambda that reverses, Base64-decodes and iteratively Zlib-decompresses. Next-stage download paths changed from /client/{sType} to /clw/{sType} (Windows) and /clw1/{sType} (macOS) and are saved as main_{sType}.py; next-stage scripts are pad0, brw0 and mc0. Trend Micro observed incomplete Cython migration, indicating active development.

Defenders should move from script-only detection to binary-aware detection: hunt for .pyd/.so/.mod files in developer directories (including .vscode), Python interpreters launched with suspicious arguments, browser-extension tampering, and Chrome/Brave downgrade on macOS. Context from PolySwarm shows the same ecosystem merging BeaverTail with OtterCookie, using RC4-encrypted HTTP C2 and a malicious npm package (node-nvm-ssh) embedded in trojanized Node.js applications.

## MITRE ATT&CK

- T1566 Phishing
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1176.001 Browser Extensions
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1082 System Information Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1056.001 Input Capture: Keylogging
- T1071.001 Application Layer Protocol: Web Protocols
- T1571 Non-Standard Port
- T1219 Remote Access Tools

## Sources

- [Analyzing Void Dokkaebi's Cython-Compiled InvisibleFerret Malware](https://www.trendmicro.com/en_us/research/26/e/analyzing-void-dokkaebi-invisibleferret-malware.html)
- [Void Dokkaebi Cython-Compiled InvisibleFerret IoC list (Trend Micro)](https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/e/void-dokkaebi-2/Void-Dokkaebi-Expands-Malware-Campaign-With-Cython-Compiled-InvisibleFerret-Info-Stealer-IoC.txt)
- [Malpedia library entry: Analyzing Void Dokkaebi's Cython-Compiled InvisibleFerret Malware](https://malpedia.caad.fkie.fraunhofer.de/library/0ef1930a-deee-4f7e-a6df-bdbc94e76ccb/)
- [PolySwarm: Famous Chollima Evolves Its Arsenal, Merging BeaverTail and OtterCookie](https://blog.polyswarm.io/famous-chollima-evolves-its-arsenal-merging-beavertail-and-ottercookie)
- [CrowdStrike Adversary Profile: Famous Chollima](https://www.crowdstrike.com/en-us/adversaries/famous-chollima/)
- [Malpedia actor: WageMole](https://malpedia.caad.fkie.fraunhofer.de/actor/wagemole)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3920