SYMBOLCOMMON_NAMEaka. SYNONYMS
js.beavertail (Back to overview)

BeaverTail

BeaverTail is a JavaScript malware primarily distributed through NPM packages. It is designed for information theft and to load further stages of malware, specifically a multi-stage Python-based backdoor known as InvisibleFerret. BeaverTail targets cryptocurrency wallets and credit card information stored in the victim's web browsers. Its code is heavily obfuscated to evade detection. Threat actors can either upload malicious NPM packages containing BeaverTail to GitHub or inject BeaverTail code into legitimate NPM projects. Researchers have identified additional Windows and macOS variants, indicating that the BeaverTail malware family is likely still under development.

References
2024-11-04 ⋅ Zscaler ⋅ Zscaler
From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West
BeaverTail InvisibleFerret WageMole
2024-10-29 ⋅ ⋅ Macnica ⋅ Hiroshi Takeuchi
Job Offer from the North: Contagious Interview for Software Developers
BeaverTail InvisibleFerret
2024-10-29 ⋅ SecurityScorecard ⋅ SecurityScorecard STRIKE Team
The Job Offer That Wasn’t: How We Stopped an Espionage Plot
BeaverTail InvisibleFerret
2024-10-24 ⋅ Datadog ⋅ Datadog
Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview
BeaverTail InvisibleFerret
2024-09-10 ⋅ Stacklok ⋅ Stacklok
Dependency hijacking: Dissecting North Korea’s new wave of DeFi-themed open source attacks targeting developers
BeaverTail InvisibleFerret
2024-09-04 ⋅ Group-IB ⋅ Sharmine Low
APT Lazarus: Eager Crypto Beavers, Video calls and Games
BeaverTail
2024-07-31 ⋅ Securonix ⋅ Securonix
Research Update: Threat Actors Behind the DEV#POPPER Campaign Have Retooled and are Continuing to Target Software Developers via Social Engineering
BeaverTail
2024-05-10 ⋅ ⋅ Qianxin Threat Intelligence Center ⋅ Threat Intelligence Center
Recruitment trap for blockchain practitioners: Analysis of suspected Lazarus (APT-Q-1) stealing operations
BeaverTail
2024-03-24 ⋅ Securonix ⋅ Securonix
Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors
BeaverTail
2023-11-21 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
BeaverTail InvisibleFerret WageMole

There is no Yara-Signature yet.