{"id":13999,"date":"2025-06-03T08:25:08","date_gmt":"2025-06-03T08:25:08","guid":{"rendered":"\/cybersecurity-blog\/?p=13999"},"modified":"2025-06-03T10:56:58","modified_gmt":"2025-06-03T10:56:58","slug":"ottercookie-malware-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/ottercookie-malware-analysis\/","title":{"rendered":"OtterCookie: Analysis of Lazarus Group Malware Targeting Finance and Tech Professionals"},"content":{"rendered":"\n

Editor\u2019s note:<\/em> The current article is authored by Mauro Eldritch, offensive security expert and threat intelligence analyst. You can <\/em><\/strong>find Mauro on X<\/em><\/strong><\/a>.<\/em><\/strong> <\/p>\n\n\n\n

What looks like a simple freelance bug fix turns out to be a full-blown malware infection. OtterCookie, a new tool from the Lazarus Group APT<\/a>, hides behind clean code and fake job offers, then silently steals credentials, crypto wallets<\/a>, and more.  <\/p>\n\n\n\n

In this step-by-step technical analysis, Mauro Eldritch<\/a> breaks down the full attack chain, supported by live insights from ANY.RUN\u2019s Interactive Sandbox<\/a>. <\/p>\n\n\n\n

Overview of OtterCookie Malware <\/h2>\n\n\n\n

North Korean state-sponsored groups, most notably Lazarus, continue to target the financial and cryptocurrency sectors using a range of custom malware families. Previously observed campaigns included threats like InvisibleFerret and Beavertail<\/a>, which were distributed through elaborate social engineering tactics such as fake developer interviews and staged business calls with executives. <\/p>\n\n\n\n

A new addition to this toolkit is OtterCookie<\/strong>, a stealer malware<\/a> that, much like its predecessors, isn\u2019t spread through random means like pirated software or infected USB drives. Instead, it is part of a broader, coordinated campaign targeting professionals in the tech, financial, and crypto industries. By staging fake interviews, threat actors deliver malware disguised either as coding challenges (or their dependencies) or video call software, in a campaign now known as Contagious Interview or DevPopper. <\/p>\n\n\n\n

OtterCookie, written in heavily obfuscated JavaScript<\/a>, was uncovered during a recent investigation conducted with the Bitso Quetzal Team. Notably, the delivery method used in this case stands out for its creativity and level of deception. <\/p>\n\n\n

\n
\"\"
Picture 1: Obfuscated code. Lazarus loves Deobfuscator.io<\/em> <\/figcaption><\/figure><\/div>\n\n\n

Key Takeaways <\/h3>\n\n\n\n