CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

BeaverTail

malware · malware:beavertail single-source-national-certsingle-source-victim

JavaScript-based malware hidden inside malicious NPM packages and downloadable from GitHub or Bitbucket, one of five malware families the DPRK WaterPlum/Contagious Interview cluster embeds in packages it has job seekers download and run as coding assignments (joint FBI/NPA-Japan/NCO-Japan/DC3/ASD-ACSC/BND/BfV Cybersecurity Advisory, 2026-09-18).

Coverage
3
2 about it · 1 mention · first 2026-08-24 → last 2026-11-05
Latest activity
2026-11-05
Sophos RCA: fake interview repo ran BeaverTail via VS Code settings; dead EDR agent, OAuth grant survived…
Peak priority
notable
2 notable
Targets
technology
sectors: technology, public-sector, finance · regions: europe
Sources cited
9
8 hosts

Defender insights

What each entry about BeaverTail tells a defender to do, newest first.

2026-11-05NOTABLESophos RCA: fake interview repo ran BeaverTail via VS Code settings; dead EDR agent, OAuth grant survived revocation

Exposure · triage · detection

2026-09-19NOTABLESeven agencies report DPRK's fake-interview crew infected 30,000+ devices and took $10.7M in crypto between December 2025 and July 2026

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

used by

Story timeline

Every entry that names BeaverTail, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-11-05Sophos's own root-cause analysis of a developer-targeted intrusion: a fake job-interview repository's VS Code workspace settings ran BeaverTail and InvisibleFerret on a Mac whose endpoint agent had not reported since 11 June, and a third-party OAuth authorization outlived the session revocation
    active-threatsSophos RCA: fake interview repo ran BeaverTail via VS Code settings; dead EDR agent, OAuth grant survived revocation
  2. 2026-09-19WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"
    active-threatsSeven agencies report DPRK's fake-interview crew infected 30,000+ devices and took $10.7M in crypto between December 2025 and July 2026
  3. 2026-08-24Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn
    mentiondeep-diveBACS report: the public sector remains the largest share of Swiss mandatory CI reports at 19.4%, and basic hygiene would have stopped the Poland sabotage

Hunting pivots

Affected products
Microsoft Visual Studio Code ×2
Tags
nation-state ×2cryptocrimeespionageidentityinfostealernorth-korea-nexusphishingsupply-chain
ATT&CK techniques (17 across 7 tactics)

17 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • ExecutionCommand and Scripting Interpreter: Unix Shell · Command and Scripting Interpreter: JavaScript · User Execution · User Execution: Malicious File
  • Credential AccessInput Capture: Keylogging · Unsecured Credentials: Private Keys · Credentials from Password Stores: Keychain · Credentials from Password Stores: Credentials from Web Browsers
  • Lateral MovementUse Alternate Authentication Material: Application Access Token
  • CollectionInput Capture: Keylogging · Screen Capture · Clipboard Data · Data from Information Repositories: Code Repositories
  • Command and ControlApplication Layer Protocol · Application Layer Protocol: Web Protocols · Ingress Tool Transfer
  • ExfiltrationExfiltration Over C2 Channel

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

T1204User Execution×1

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Credential Access TA0006

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1552.004Unsecured Credentials: Private Keys×1

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

T1555.001Credentials from Password Stores: Keychain×1

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×2

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Lateral Movement TA0008

T1550.001Use Alternate Authentication Material: Application Access Token×1

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

Collection TA0009

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1113Screen Capture×1

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1115Clipboard Data×1

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1213.003Data from Information Repositories: Code Repositories×1

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

Command and Control TA0011

T1071Application Layer Protocol×1

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

Exfiltration TA0010

T1041Exfiltration Over C2 Channel×1

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Evidence: 2026-11-05/sophos-rca-fake-interview-repo-vscode-beavertail-edr-gap · ATT&CK page ↗

Entries about BeaverTail (2)

2026-11-05 · view entry permalink →

NOTABLENATOB2

Sophos's own root-cause analysis of a developer-targeted intrusion: a fake job-interview repository's VS Code workspace settings ran BeaverTail and InvisibleFerret on a Mac whose endpoint agent had not reported since 11 June, and a third-party OAuth authorization outlived the session revocation

On 2026-09-14 a Sophos employee cloned a public repository presented as a job-interview coding assignment and opened it as a workspace in VS Code; a weaponized workspace settings file replaced the editor's integrated terminal profile with a command that downloads and runs a remote script in a loop, delivery relied on the user opening the workspace as trusted, and no exploit or vulnerability was involved (Sophos RCA, 2026-11-04). Opening a terminal was enough: a shell script fetched a JavaScript component and a package manifest into a hidden directory in the user profile, a package-manager install ran, the JavaScript ran under Node.js and the final-stage backdoor lived in memory only, with no persistence found (Sophos RCA, 2026-11-04). SophosLabs identified the BeaverTail loader followed by the InvisibleFerret backdoor, able to steal browser-stored credentials, keychain data and SSH keys, and the JavaScript stage sent the process environment to an attacker web endpoint on a cloud application-hosting service (Sophos RCA, 2026-11-04).

Two gaps lengthened the exposure. The Sophos Endpoint agent was installed but its core services were not running, so it enforced nothing and reported nothing; the device was last seen in Sophos Central on 2026-06-11, the cause is still under investigation, and SophosLabs says a working agent would have blocked the chain at the first dropped file (Sophos RCA, 2026-11-04). A third-party application authorization on the employee's source-code platform account survived the session revocation and password reset of 2026-09-15 and made 27 read requests against two internal repositories from an address new to the user until it was revoked on 2026-09-16; Sophos found no other host, no cloud activity and no customer impact (Sophos RCA, 2026-11-04). The analysis names no group; Sophos CTU says the technique matches the tradecraft of NICKEL ALLEY, which it describes as running the Contagious Interview campaign of fake companies, fake recruiters and malicious code repositories (Sophos blog, 2026-11-04).

Triage: a terminal profile normally launches a shell executable; this one launched a command that downloads and runs a remote script in a loop; it came from the settings of a freshly cloned repository (Sophos RCA, 2026-11-04).

The repository contained a weaponized VS Code workspace settings file that replaced the editor’s integrated terminal profile. When a terminal opened in the workspace, the modified profile silently downloaded and ran a multi-stage payload.

The Sophos Endpoint agent was installed on the employee’s device but was not functional.

Sophos (root-cause analysis INC-2026-002) 2026-11-04

Builds on: Binance's report: fake recruiter, trojaned pyenv, AI-tool pivot and a deployment token reached…

incident05 Nov 03:57Zsingle-source · victim disclosureOpen finding →
Sources: Sophos (root-cause analysis INC-2026-002) · Sophos (blog)

2026-09-19 · view entry permalink →

NOTABLEupdatedNATOA1

WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"

Seven government agencies (Japan's National Police Agency and National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND and BfV) jointly published a Cybersecurity Advisory on 2026-09-18 on the North Korean "WaterPlum" cyber-actor group, publicly known as Contagious Interview (FBI/IC3, 2026-09-18). The advisory puts figures on the campaign from around December 2025 through July 2026: at least 30,000 infected devices across more than 100 countries, funds or credentials exfiltrated from over 7,000 cryptocurrency wallets, and roughly 1.7 billion Japanese yen (about USD 10.7 million) moved to DPRK (FBI/IC3, 2026-09-18). Germany's BfV confirms the campaign has targeted software developers "also in Germany" (translated from German) (Bundesamt für Verfassungsschutz, 2026-09-18).

WaterPlum poses as recruiters, frequently impersonating AI, cryptocurrency or NFT companies and also using legitimate freelance and recruiting platforms, to lure software developers and IT professionals into a technical interview or take-home coding assignment; victims are told to download and run files hosted on collaboration platforms and code repositories to "complete a coding assignment or troubleshoot an error." Those files carry one of five malware families the advisory names: BeaverTail (JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket), InvisibleFerret (a Python backdoor), OtterCookie (a JavaScript RAT and infostealer), OtterCandy (combining OtterCookie and RATatouille features), and StoatWaffle, a modular Node.js loader, credential harvester and RAT that hides inside blockchain-themed decoy VS Code project repositories and auto-executes through a malicious VS Code configuration file the moment the victim opens and trusts the folder (FBI/IC3, 2026-09-18). Once backdoored, operators use the RATs for persistence and lateral pivoting while infostealers harvest browser-stored credentials, clipboard contents, keystrokes, screenshots and cryptocurrency-wallet data to a command-and-control address; the same access lets operators pursue further espionage or intellectual-property theft inside the victim's employer.

The advisory ties the malware-delivery operation to North Korea's remote-IT-worker placement scheme: "the NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea" (FBI/IC3, 2026-09-18). It adds that some WaterPlum actors also operate as North Korean IT workers, and that both used the same IP addresses when accessing laptop farms, using crowdsourcing services and applying for positions at a Japanese cryptocurrency exchange (FBI/IC3, 2026-09-18). Separately, Japanese authorities "for the first time in Japan" identified and dismantled a "laptop farm" operated by an enabler in Japan, and obtained evidence that the actor group transferred "several hundred million" yen in cryptocurrency abroad. The advisory defines a laptop farm as a location, often an enabler's residence, where employment-related computers are set up and remotely controlled by North Korean IT workers (FBI/IC3, 2026-09-18). The advisory records two prior cases of IT-worker escalation beyond simple wage fraud: one worker extorted a company over payment and published its proprietary source code online, and another defaced and disabled a hiring company's website (FBI/IC3, 2026-09-18).

Triage: the advisory lists the data the actors' infostealers target (browser authentication data, clipboard contents, keystrokes, screenshots and wallet data) and the StoatWaffle delivery through a malicious VS Code configuration file that runs when the folder is opened and trusted (FBI/IC3, 2026-09-18). It gives no process lineage, so as a hunting hypothesis expect a node or python process spawned from an IDE or terminal shortly after a new project folder is opened or npm install completes, then reading browser credential stores or the clipboard; legitimate build tooling does neither. The distinguishing context is timing correlation with an active job-interview or coding-test process rather than node, npm or VS Code activity alone.

WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets. WaterPlum actors have transferred 1.7 billion Japanese yen (JPY) (equivalent to 10.71 million USD) of cryptocurrency assets to the Democratic People's Republic of Korea (DPRK).

WaterPlum actors upload malicious Node Package Manager (NPM) packages embedded with either BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle malware and related variants.

The NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea.

For the first time in Japan, authorities successfully identified, investigated, and dismantled a "laptop farm" operated by an enabler in Japan.

FBI/IC3 Joint Cybersecurity Advisory 2026-09-18
Correctionrun 2026-09-30T0639Z-auditprioritybodytitlesummaryentitiesheadline

The advisory does not name the IT-worker scheme by any vendor alias, and it does not claim to be the first to quantify the campaign or to name its five malware families together. Its only first is Japan's dismantled laptop farm. It gives its device, wallet and USD 10.7 million figures for the period from around December 2025 through July 2026, not for the campaign as a whole. Its interview flags for suspected North Korean IT workers are refusals or excuses regarding in-person meetings, requests for cryptocurrency payment, glances at another monitor, background voices, and repeated video or audio freezes (FBI/IC3, 2026-09-18).

The advisory describes BeaverTail as JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket, not as a loader (FBI/IC3, 2026-09-18).

Correctionrun 2026-10-11T1307Z-auditbody

The joint advisory lists the data the actors' infostealers target and describes a malicious VS Code configuration file that runs code when the folder is opened and trusted, but it gives no process lineage or network pattern (FBI/IC3, 2026-09-18). The node or python process chain in the triage guidance is a hunting hypothesis, not behavior the agencies report. The takeaway's first control now addresses the people the fake recruiters approach: software developers and other IT professionals looking for work, who are asked during a supposed application process to download a file that contains the malware (heise online, 2026-09-18).

Builds on: A Swiss research lab co-publishes the DPRK actor-tracking update: two nominally-espionage…

threat19 Sep 04:40Zmulti-sourceOpen finding →
Sources: FBI/IC3 Joint Cybersecurity Advisory · Bundesamt für Verfassungsschutz (Germany) · The Record (Recorded Future News) · heise online

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2
  • Deep dive1

Source distribution

  • sophos.com2 (22%)
  • bacs.admin.ch1 (11%)
  • cms.news.admin.ch1 (11%)
  • expel.com1 (11%)
  • heise.de1 (11%)
  • ic3.gov1 (11%)
  • therecord.media1 (11%)
  • verfassungsschutz.de1 (11%)
All cited sources (9)