# Famous Chollima (North Korea) APT: Contagious Interview Campaigns, BeaverTail/OtterCookie/InvisibleFerret Malware and Fake IT Worker Operations

> Famous Chollima is a North Korean state-sponsored, financially motivated APT group active since at least 2018. It targets software developers and cryptocurrency professionals through fake recruiter lures, malicious npm packages and ClickFix, delivering BeaverTail, OtterCookie, InvisibleFerret, GolangGhost, PylangGhost and PolinRider, while also placing fake IT workers in Western companies to funnel salaries to the DPRK.

- **Published:** 2026-10-24T10:26:16Z
- **Last reviewed:** 2026-10-24T10:26:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4366
- **ID:** TL-2026-4366
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Famous Chollima (a.k.a. WageMole, Contagious Interview, Nickel Tapestry, PurpleBravo, Storm-1877, UNC5267, Void Dokkaebi, WaterPlum, Tenacious Pungsan) is a DPRK-nexus cluster described by Cisco Talos as a Lazarus-aligned subgroup. It runs two intertwined operations: (1) the Contagious Interview campaign, operational since at least December 2022, in which fake recruiters and fake crypto companies (for example BlockNovas) lure developers and crypto professionals into running trojanized coding tests, installing fake conferencing software or pasting ClickFix commands; and (2) a fraudulent remote IT-worker scheme in which operatives use falsified identities and US-based laptop farms to obtain jobs and funnel salary to North Korea.

Initial access relies on social engineering via professional networking and messaging services, followed by delivery through malicious npm packages (more than 2,500 packages are reported to be tied to the operation, hiding payloads behind hundreds of spaces or blank lines), trojanized Git repositories (for example the Chessfi chess application that pulls the node-nvm-ssh dependency), npm lifecycle scripts (prepare, start, postinstall), VS Code tasks using runOn folderOpen, .githooks, and payloads disguised as .woff2 font or SVG files. Payload staging abuses legitimate services such as jsonkeeper.com and api.mocki.io. In February 2025 the actor began hiding malware in BNB Chain and Ethereum smart contracts (EtherHiding) and adopted ClickFix lures delivering the GolangGhost backdoor. In March 2026 the PolinRider activity implanted obfuscated JavaScript in hundreds of GitHub repositories to spread a BeaverTail variant.

Malware: BeaverTail is a JavaScript stealer/downloader that harvests browser credentials and crypto-wallet extension data, fetches helper modules from its C2 (for example /node/<node_version>) and downloads InvisibleFerret Python modules (Talos observed delivery from port 1224). OtterCookie (first deployed around September 2024, now at v5) is JavaScript malware using Socket.IO, with VM checks (reading /proc/cpuinfo for hypervisor names), keylogging via node-global-key-listener, screenshots via screenshot-desktop, clipboard exfiltration, file harvesting (*.env*, wallet, metamask, phantom, *.doc, *.pdf, *.json) and a remote shell. BeaverTail and OtterCookie functionality has increasingly merged. InvisibleFerret is a Python backdoor with directory/specific-file/pattern file collection, pyperclip-based clipboard theft and raw TCP C2. PylangGhost is a Python RAT using RC4 (message: 16-byte MD5 checksum, 128-byte RC4 key in clear, then ciphertext) that steals browser credentials and session cookies and targets more than 80 extensions. Operators commonly use Astrill, Browsec and Touch VPN, and AnyDesk and other RMM tools.

On the IT-worker side, CrowdStrike reports tradecraft such as filing fraudulent police reports to obtain replacement laptops, rotating residential addresses, spoofing device hashes (video capture cards presented as webcams, from May 2026), PiKVM/KVM use and RMM installation. In late September 2026 the FBI searched about 40 residences in Texas (operation 'Lonestar Roundup') with CrowdStrike assistance, seizing roughly 187 laptops and KVM devices; the DOJ charged 14 individuals. In August 2025 US sanctions exposed about $600K in crypto-to-cash transfers.

## MITRE ATT&CK

- T1583.001 Domains
- T1585 Establish Accounts
- T1608.001 Upload Malware
- T1195.001 Compromise Software Dependencies and Development Tools
- T1566.003 Spearphishing via Service
- T1684.001 Impersonation
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1204.005 Malicious Library
- T1027 Obfuscated Files or Information
- T1036.008 Masquerade File Type
- T1497.001 System Checks
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1657 Financial Theft

## Sources

- [Famous Chollima APT Group: Major Activities, TTPs, and Simulation (Picus Security)](https://www.picussecurity.com/resource/blog/famous-chollima-apt-group-major-activities-ttps-and-simulation)
- [U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance](https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/)
- [BeaverTail and OtterCookie evolve with a new Javascript module (Cisco Talos)](https://blog.talosintelligence.com/beavertail-and-ottercookie/)
- [Famous Chollima evolves its arsenal, merging BeaverTail and OtterCookie (PolySwarm)](https://blog.polyswarm.io/famous-chollima-evolves-its-arsenal-merging-beavertail-and-ottercookie)
- [WaterPlum / OtterCookie analysis (NTT Security Japan)](https://jp.security.ntt/tech_blog/en-waterplum-ottercookie)
- [North Korean Hackers Deploy OtterCookie Malware (The Hacker News)](https://thehackernews.com/2024/12/north-korean-hackers-deploy-ottercookie.html)
- [FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested (BleepingComputer)](https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/)
- [US raids laptop farms used to funnel $3 million to North Korea in fake candidate scam (ITPro)](https://www.itpro.com/security/us-raids-laptop-farms-used-to-funnel-usd3-million-to-north-korea-in-fake-candidate-scam)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4366