CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

StoatWaffle

malware · malware:stoatwaffle

Modular Node.js malware family combining a loader, credential-harvesting components and a RAT, delivered via malicious Visual Studio Code project configurations using blockchain-themed decoy repositories that auto-execute on folder-open/trust; attributed to the DPRK WaterPlum/Contagious Interview cluster (joint FBI/NPA-Japan/NCO-Japan/DC3/ASD-ACSC/BND/BfV Cybersecurity Advisory, 2026-09-18).

Coverage
1
first 2026-09-19 → last 2026-09-30
Latest activity
2026-09-19
Seven agencies report DPRK's fake-interview crew infected 30,000+ devices and took $10.7M in crypto between…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, technology, finance · regions: europe
Sources cited
4
4 hosts

Defender insights

What each entry about StoatWaffle tells a defender to do, newest first.

2026-09-19NOTABLESeven agencies report DPRK's fake-interview crew infected 30,000+ devices and took $10.7M in crypto between December 2025 and July 2026

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

used by

Story timeline

  1. 2026-09-19WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"
    active-threatsSeven agencies report DPRK's fake-interview crew infected 30,000+ devices and took $10.7M in crypto between December 2025 and July 2026

Hunting pivots

Affected products
Microsoft Visual Studio Code
Tags
cryptocrimeespionagenation-statenorth-korea-nexusphishingsupply-chain
ATT&CK techniques (7 across 5 tactics)

7 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • ExecutionUser Execution: Malicious File
  • Credential AccessInput Capture: Keylogging · Credentials from Password Stores: Credentials from Web Browsers
  • CollectionInput Capture: Keylogging · Screen Capture · Clipboard Data
  • Command and ControlApplication Layer Protocol

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Execution TA0002

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Credential Access TA0006

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Collection TA0009

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1113Screen Capture×1

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

T1115Clipboard Data×1

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Command and Control TA0011

T1071Application Layer Protocol×1

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-19/waterplum-contagious-interview-joint-advisory-scale · ATT&CK page ↗

Entries about StoatWaffle (1)

2026-09-19 · view entry permalink →

NOTABLEupdatedNATOA1

WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"

Seven government agencies (Japan's National Police Agency and National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND and BfV) jointly published a Cybersecurity Advisory on 2026-09-18 on the North Korean "WaterPlum" cyber-actor group, publicly known as Contagious Interview (FBI/IC3, 2026-09-18). The advisory puts figures on the campaign from around December 2025 through July 2026: at least 30,000 infected devices across more than 100 countries, funds or credentials exfiltrated from over 7,000 cryptocurrency wallets, and roughly 1.7 billion Japanese yen (about USD 10.7 million) moved to DPRK (FBI/IC3, 2026-09-18). Germany's BfV confirms the campaign has targeted software developers "also in Germany" (translated from German) (Bundesamt für Verfassungsschutz, 2026-09-18).

WaterPlum poses as recruiters, frequently impersonating AI, cryptocurrency or NFT companies and also using legitimate freelance and recruiting platforms, to lure software developers and IT professionals into a technical interview or take-home coding assignment; victims are told to download and run files hosted on collaboration platforms and code repositories to "complete a coding assignment or troubleshoot an error." Those files carry one of five malware families the advisory names: BeaverTail (JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket), InvisibleFerret (a Python backdoor), OtterCookie (a JavaScript RAT and infostealer), OtterCandy (combining OtterCookie and RATatouille features), and StoatWaffle, a modular Node.js loader, credential harvester and RAT that hides inside blockchain-themed decoy VS Code project repositories and auto-executes through a malicious VS Code configuration file the moment the victim opens and trusts the folder (FBI/IC3, 2026-09-18). Once backdoored, operators use the RATs for persistence and lateral pivoting while infostealers harvest browser-stored credentials, clipboard contents, keystrokes, screenshots and cryptocurrency-wallet data to a command-and-control address; the same access lets operators pursue further espionage or intellectual-property theft inside the victim's employer.

The advisory ties the malware-delivery operation to North Korea's remote-IT-worker placement scheme: "the NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea" (FBI/IC3, 2026-09-18). It adds that some WaterPlum actors also operate as North Korean IT workers, and that both used the same IP addresses when accessing laptop farms, using crowdsourcing services and applying for positions at a Japanese cryptocurrency exchange (FBI/IC3, 2026-09-18). Separately, Japanese authorities "for the first time in Japan" identified and dismantled a "laptop farm" operated by an enabler in Japan, and obtained evidence that the actor group transferred "several hundred million" yen in cryptocurrency abroad. The advisory defines a laptop farm as a location, often an enabler's residence, where employment-related computers are set up and remotely controlled by North Korean IT workers (FBI/IC3, 2026-09-18). The advisory records two prior cases of IT-worker escalation beyond simple wage fraud: one worker extorted a company over payment and published its proprietary source code online, and another defaced and disabled a hiring company's website (FBI/IC3, 2026-09-18).

Triage: BeaverTail/InvisibleFerret/OtterCookie-family execution shows up as a node or python process spawned from an IDE or terminal session shortly after a new project folder is opened or an npm install completes, followed by outbound connections to non-corporate destinations and API calls against browser credential stores or the clipboard; legitimate build tooling does not read browser credential stores or poll the clipboard. StoatWaffle's variant of the same pattern is a VS Code auto-run entry (a .vscode configuration file) firing on folder-open/trust in a freshly cloned, blockchain-themed repository the organization's own ticketing has no record of. The distinguishing context, in both cases, is timing correlation with an active job-interview or coding-test process rather than the presence of node/npm/VS Code activity alone.

WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets. WaterPlum actors have transferred 1.7 billion Japanese yen (JPY) (equivalent to 10.71 million USD) of cryptocurrency assets to the Democratic People's Republic of Korea (DPRK).

WaterPlum actors upload malicious Node Package Manager (NPM) packages embedded with either BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle malware and related variants.

The NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea.

For the first time in Japan, authorities successfully identified, investigated, and dismantled a "laptop farm" operated by an enabler in Japan.

FBI/IC3 Joint Cybersecurity Advisory 2026-09-18
Correctionrun 2026-09-30T0639Z-auditprioritybodytitlesummaryentitiesheadline

The advisory does not name the IT-worker scheme by any vendor alias, and it does not claim to be the first to quantify the campaign or to name its five malware families together. Its only first is Japan's dismantled laptop farm. It gives its device, wallet and USD 10.7 million figures for the period from around December 2025 through July 2026, not for the campaign as a whole. Its interview flags for suspected North Korean IT workers are refusals or excuses regarding in-person meetings, requests for cryptocurrency payment, glances at another monitor, background voices, and repeated video or audio freezes (FBI/IC3, 2026-09-18).

The advisory describes BeaverTail as JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket, not as a loader (FBI/IC3, 2026-09-18).

Builds on: A Swiss research lab co-publishes the DPRK actor-tracking update: two nominally-espionage…

threat19 Sep 04:40Zmulti-sourceOpen finding →
Sources: FBI/IC3 Joint Cybersecurity Advisory · Bundesamt für Verfassungsschutz (Germany) · The Record (Recorded Future News) · heise online

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • heise.de1 (25%)
  • ic3.gov1 (25%)
  • therecord.media1 (25%)
  • verfassungsschutz.de1 (25%)
All cited sources (4)