Palo Alto Networks reported the Contagious Interview marketing campaign in November 2023, a financially motivated assault focusing on varied organizations, in contrast to typical nation-sponsored assaults.
Whereas primarily related to BeaverTail and InvisibleFerret malware, SOCs have lately noticed OtterCookie deployed inside this marketing campaign.
OtterCookie reveals distinct habits from its predecessors, demonstrating the marketing campaign’s evolution and increasing menace panorama, which highlights the significance of steady monitoring and menace intelligence updates for organizations to successfully mitigate the dangers posed by Contagious Interview.
Contagious Interview assaults, which exploit vulnerabilities in software program improvement processes, are more and more originating from numerous sources.
Whereas Node.js tasks and npm packages stay widespread assault vectors, attackers at the moment are focusing on purposes constructed with Qt and Electron frameworks, which demonstrates lively experimentation by attackers to determine and exploit new vulnerabilities within the software program provide chain.
Earlier analysis documented loaders that fetch JSON information, extract a “cookie” property, and execute it as JavaScript code, as an identical sample the place loaders obtain JavaScript code instantly, triggering a 500 HTTP standing code and executing the code inside the ensuing catch block.
This loader primarily delivers BeaverTail malware, although OtterCookie infections have been famous and in addition encountered cases of simultaneous OtterCookie and BeaverTail executions.
OtterCookie, a malware noticed in November 2024, makes use of Socket.IO for distant communication and may execute shell instructions (command) and steal machine data (whour) upon receiving distant instructions through the socketServer perform.
Evaluation of the instructions despatched by the socketServer perform revealed that OtterCookie collects cryptocurrency pockets keys from doc, picture, and cryptocurrency-related information and sends them to a distant server by utilizing ls and cat instructions for atmosphere reconnaissance.
The OtterCookie model that was launched in November has improved capabilities for stealing cryptocurrency keys compared to the model that was launched in September.
Whereas each variations can steal keys, November leverages distant shell instructions for this goal, whereas September depends on common expression-based checks inside the `checkForSensitiveData` perform.
November introduces clipboard monitoring performance utilizing the `clipboardy` library to exfiltrate delicate information from the sufferer’s machine to a distant location, a function absent within the September OtterCookie.
Based on NTT, contagious Interview, a menace actor group, has deployed a brand new malware variant known as OtterCookie, which targets and steals browser cookies, probably compromising consumer accounts.
The assault vector stays beneath investigation, however the menace actor is actively evolving its techniques, as researchers have noticed assaults in Japan, indicating a broadening geographical scope.
