OtterCandy Propose Change

Actor(s): WageMole

OtterCandy is a cross-platform JavaScript backdoor targeting Windows, macOS, and Linux that uses the Socket.IO library with WebSocket and HTTP long-polling transports for command and control, connecting to a hardcoded C2 server with unlimited reconnection attempts. It exfiltrates data via HTTP multipart POST and JSON-body requests to the same C2 infrastructure. It focuses on credential theft from Chromium-based browsers (Chrome, Edge, Brave, Opera, Yandex) by decrypting SQLite login and cookie databases using Windows DPAPI on Windows and Keychain-derived PBKDF2+AES-128-CBC on macOS. It targets cryptocurrency wallets through both browser extension LevelDB scanning (MetaMask, Phantom, Coinbase Wallet, Exodus Web3, Keplr, Enkrypt, OKX) and desktop wallet directory collection (Exodus, Guarda, Electrum, Atomic). The malware conducts recursive filesystem searches to gather .env files and files matching sensitive keywords (metamask, phantom, hardhat.config.ts, seed), and separately collects shell history (.bash_history), Google Cloud (~/.config/gcloud), and Azure (~/.azure) credentials. It fingerprints victims by combining hostname with the first six characters of a hardware machine ID to generate a unique victim identifier used on all uploads. The implant forks a secondary Node.js process from a co-located express.js file on startup, indicating a multi-component architecture within the same delivery package.

References

There is no Yara-Signature yet.