Threat reportAPTTL-2026-4366
Famous Chollima (North Korea) APT: Contagious Interview Campaigns, BeaverTail/OtterCookie/InvisibleFerret Malware and Fake IT Worker Operations
Famous Chollima (North Korea) APT (TL-2026-4366), also tracked as Contagious Interview, is a high-severity advanced persistent threat campaign, first published 2026-10-24. It is attributed to WageMole (North Korea) with high confidence, affects Various Developer workstations (Windows, macOS, Linux) running, maps to 18 MITRE ATT&CK techniques (T1027, T1036.008, T1056.001), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 1WageMole
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4366
- Threat ID
- TL-2026-4366
- Also known as
- Contagious Interview, Lonestar Roundup (law-enforcement operation), PolinRider, EtherHiding campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, finance, aerospace, energy, health, defense, government administration, communications, manufacturing
- Target regions
- North America, india, Asia, Europe
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Famous Chollima (North Korea) APT
Malware and tooling: BeaverTail - S1246, GolangGhost (OS X), InvisibleFerret - S1245, OtterCookie, PylangGhost
How Famous Chollima (North Korea) APT works
Famous Chollima is a North Korean state-sponsored, financially motivated APT group active since at least 2018. It targets software developers and cryptocurrency professionals through fake recruiter lures, malicious npm packages and ClickFix, delivering BeaverTail, OtterCookie, InvisibleFerret, GolangGhost, PylangGhost and PolinRider, while also placing fake IT workers in Western companies to funnel salaries to the DPRK.
Famous Chollima (a.k.a. WageMole, Contagious Interview, Nickel Tapestry, PurpleBravo, Storm-1877, UNC5267, Void Dokkaebi, WaterPlum, Tenacious Pungsan) is a DPRK-nexus cluster described by Cisco Talos as a Lazarus-aligned subgroup. It runs two intertwined operations: (1) the Contagious Interview campaign, operational since at least December 2022, in which fake recruiters and fake crypto companies (for example BlockNovas) lure developers and crypto professionals into running trojanized coding tests, installing fake conferencing software or pasting ClickFix commands; and (2) a fraudulent remote IT-worker scheme in which operatives use falsified identities and US-based laptop farms to obtain jobs and funnel salary to North Korea.
Initial access relies on social engineering via professional networking and messaging services, followed by delivery through malicious npm packages (more than 2,500 packages are reported to be tied to the operation, hiding payloads behind hundreds of spaces or blank lines), trojanized Git repositories (for example the Chessfi chess application that pulls the node-nvm-ssh dependency), npm lifecycle scripts (prepare, start, postinstall), VS Code tasks using runOn folderOpen, .githooks, and payloads disguised as .woff2 font or SVG files. Payload staging abuses legitimate services such as jsonkeeper.com and api.mocki.io. In February 2025 the actor began hiding malware in BNB Chain and Ethereum smart contracts (EtherHiding) and adopted ClickFix lures delivering the GolangGhost backdoor. In March 2026 the PolinRider activity implanted obfuscated JavaScript in hundreds of GitHub repositories to spread a BeaverTail variant.
Malware: BeaverTail is a JavaScript stealer/downloader that harvests browser credentials and crypto-wallet extension data, fetches helper modules from its C2 (for example /node/<node_version>) and downloads InvisibleFerret Python modules (Talos observed delivery from port 1224). OtterCookie (first deployed around September 2024, now at v5) is JavaScript malware using Socket.IO, with VM checks (reading /proc/cpuinfo for hypervisor names), keylogging via node-global-key-listener, screenshots via screenshot-desktop, clipboard exfiltration, file harvesting (*.env*, wallet, metamask, phantom, *.doc, *.pdf, *.json) and a remote shell. BeaverTail and OtterCookie functionality has increasingly merged. InvisibleFerret is a Python backdoor with directory/specific-file/pattern file collection, pyperclip-based clipboard theft and raw TCP C2. PylangGhost is a Python RAT using RC4 (message: 16-byte MD5 checksum, 128-byte RC4 key in clear, then ciphertext) that steals browser credentials and session cookies and targets more than 80 extensions. Operators commonly use Astrill, Browsec and Touch VPN, and AnyDesk and other RMM tools.
On the IT-worker side, CrowdStrike reports tradecraft such as filing fraudulent police reports to obtain replacement laptops, rotating residential addresses, spoofing device hashes (video capture cards presented as webcams, from May 2026), PiKVM/KVM use and RMM installation. In late September 2026 the FBI searched about 40 residences in Texas (operation 'Lonestar Roundup') with CrowdStrike assistance, seizing roughly 187 laptops and KVM devices; the DOJ charged 14 individuals. In August 2025 US sanctions exposed about $600K in crypto-to-cash transfers.
MITRE ATT&CK techniques used in TL-2026-4366
Defense Evasion
T1027 Obfuscated Files or Information; T1036.008 Masquerade File Type; T1497.001 System Checks
Credential Access
T1056.001 Keylogging; T1555.003 Credentials from Web Browsers
Execution
T1059.007 JavaScript; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste; T1204.005 Malicious Library
Command and Control
Collection
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1566.003 Spearphishing via Service
Resource Development
T1583.001 Domains; T1585 Establish Accounts; T1608.001 Upload Malware
Impact
stealth
Affected products and versions in Famous Chollima (North Korea) APT
- Various — Developer workstations (Windows, macOS, Linux) running Node.js/npm, Python and VS Code
Vulnerable versions: Any - social-engineering driven, no software vulnerability - npm — npm registry packages (e.g. node-nvm-ssh)
Vulnerable versions: Trojanized packages tied to the operation - Various — Remote-hire / HR processes and employer-issued laptops
Vulnerable versions: Organizations hiring remote IT staff without strong identity verification
Remediation for Famous Chollima (North Korea) APT
Immediate actions
- Block and hunt for the network IOCs listed (C2 IPs/ports, domains) and the abused staging services jsonkeeper.com and api.mocki.io where not business-required
- Hunt for node-nvm-ssh and other trojanized npm dependencies; audit npm lifecycle scripts (prepare, start, postinstall), .githooks and VS Code tasks with runOn folderOpen in recently cloned repositories
- Search endpoints for OtterCookie artifacts such as windows-cache/1.tmp and windows-cache/2.jpeg and for unexpected AnyDesk installs
- Rotate credentials and revoke sessions on developer workstations where BeaverTail/OtterCookie execution is suspected; move crypto wallet funds to new wallets
Workarounds
- Disable or restrict VS Code workspace auto-run tasks (workspace trust) and Git hooks from untrusted repositories
- Block unsanctioned remote access tools (AnyDesk and other RMM) on corporate devices
Longer-term hardening
- Run developer interview coding tests and unknown repositories only in isolated VMs or disposable environments
- Restrict npm install of unvetted packages (private registry/allow-list, --ignore-scripts) and monitor for packages with abnormal whitespace padding
- Train staff and recruiters on fake-recruiter and ClickFix lures; prohibit pasting commands from web pages into terminals
- Strengthen remote-hire identity verification and monitor for laptop-farm indicators: RMM/PiKVM use, Astrill VPN, timezone and address mismatches, reused phone/email/bank details
- Deploy EDR with behavioral detection for Node.js spawning shells, Python downloaders and browser credential-store access
Timeline of Famous Chollima (North Korea) APT
- Famous Chollima becomes active conducting operations to obtain IT jobs (active since at least 2018).
- Contagious Interview campaign begins, impersonating recruiters to target developers.
- BeaverTail initial discovery (per Cisco Talos timeline).
- Palo Alto Networks Unit 42 publishes early research on the Contagious Interview campaign.
- Developers targeted with malicious npm packages; falsified identity documents used.
- OtterCookie JavaScript malware introduced via a fake FreeConference installer.
- Malware hidden in BNB Chain and Ethereum smart contracts (EtherHiding); ClickFix lures deploy the GolangGhost backdoor.
- Fake crypto companies such as BlockNovas created for job interviews; OtterCookie v4 with VM evasion observed.
- PylangGhost Python RAT deployed through fake crypto skill tests.
- US sanctions expose about $600K in crypto-to-cash transfers; OtterCookie v5 campaign observed against a Sri Lankan organization.
- Cisco Talos publicly details merged BeaverTail/OtterCookie v5 modules (keylogger, screenshots, remote shell, file upload).
- PolinRider activity implants obfuscated JavaScript in hundreds of GitHub repositories to spread a BeaverTail variant.
- CrowdStrike observes operators begin spoofing device hashes (e.g. capture cards appearing as webcams).
- FBI searches about 40 Texas residences hosting laptop farms (Sept 21-25), seizing roughly 187 laptops/KVM devices with CrowdStrike assistance.
- CrowdStrike publishes details of the disruption; DOJ reports 14 individuals charged.
Sources cited for Famous Chollima (North Korea) APT
- Famous Chollima APT Group: Major Activities, TTPs, and Simulation (Picus Security)
- U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
- BeaverTail and OtterCookie evolve with a new Javascript module (Cisco Talos)
- Famous Chollima evolves its arsenal, merging BeaverTail and OtterCookie (PolySwarm)
- WaterPlum / OtterCookie analysis (NTT Security Japan)
- North Korean Hackers Deploy OtterCookie Malware (The Hacker News)
- FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested (BleepingComputer)
- US raids laptop farms used to funnel $3 million to North Korea in fake candidate scam (ITPro)
Detection coverage for TL-2026-4366
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4366 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4366
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.