Malware

StoatWaffle

StoatWaffle Malware is a lightweight JavaScript-based backdoor trojan active since at least October 2025 that enables persistent, stealthy remote control over infected systems by continuously beaconing to a command-and-control server approximately every 5 seconds. The First-Stage Module performs host fingerprinting — collecting hostname, MAC address, operating system details, and the complete Node.js process environment (process.env), which frequently contains cloud credentials, API keys, and CI/CD secrets — and executes attacker-supplied payloads via eval(). The Second-Stage Module additionally collects the victim's public IP address, spawns attacker-supplied payloads as isolated detached child processes using the local Node.js runtime, and supports process ID tracking, remote agent UUID and session token updates, and an operator-controlled kill-switch that terminates all tracked child processes and self-exits on command. Both modules suppress SIGHUP signals and hide spawned process windows to reduce visibility, report errors to the C2 server via a dedicated telemetry endpoint, and together allow attackers to steal secrets, deliver additional payloads, execute arbitrary commands, and maintain ongoing process-level control with the privileges of the compromised user.

Indicators of Compromise 1

Domain mouse-review[.]discord[.]gg

MITRE ATT&CK TTPs 8

T1021.003
Distributed Component Object Model
Lateral Movement
 T1059
Command and Scripting Interpreter
Execution
 T1071
Application Layer Protocol
Command And Control
 T1071.001
Web Protocols
Command And Control
 T1204.002
Malicious File
Execution
 T1566
Phishing
Initial Access
 T1566.001
Spearphishing Attachment
Initial Access
 T1573
Encrypted Channel
Command And Control

Source Articles

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
North Korean threat actors associated with the Contagious Interview campaign have compromised over 30,000 devices across more than 100 countries since at least 2022, targeting software developers and IT professionals in cryptocurrency, blockchain, and Web3 sectors. The attackers pose as recruiters on platforms like LinkedIn, offering fake job opportunities that lead to multi-stage malware infections. Malware families deployed include BeaverTail, InvisibleFerret, and RATatouille, enabling credential theft, cryptocurrency theft, and lateral movement into corporate networks. A related operation uses Western proxies recruited via Discord to bypass sanctions and identity checks, with North Korean IT workers using AI-generated identities to secure remote jobs and steal funds.
hacker-news ·1mo ago
North Korean WaterPlum hackers infected 30,000 devices worldwide
North Korean threat actor WaterPlum conducted a global campaign from December 2025 to July 2026, compromising over 30,000 devices and stealing more than $10.7 million in cryptocurrency. The group targeted job seekers by impersonating legitimate companies and delivering malware through malicious npm packages and Visual Studio Code projects. WaterPlum deployed multiple malware families including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal credentials, cryptocurrency keys, and conduct espionage. The actors are linked to North Korea's 313 General Bureau and operate alongside fraudulent IT worker operations using stolen identities and AI face-swapping during fake interviews.
bleeping-computer ·1mo ago