InvisibleFerret (Malware Family) By Fraunhofer FKIE Archived: 2026-04-05 14:19:45 UTC InvisibleFerret Actor(s): WageMole There is no description at this point. References 2026-03-11 ⋅ Microsoft ⋅ Microsoft Defender Experts, Microsoft Defender Security Research Team Contagious Interview: Malware delivered through fake developer job interviews BeaverTail OtterCookie StoatWaffle InvisibleFerret PylangGhost GolangGhost 2026-01-20 ⋅ Abstract Security ⋅ Contagious Interview: Tracking the VS Code Tasks Infection Vector BeaverTail InvisibleFerret 2026-01-13 ⋅ Security Alliance ⋅ Security Alliance VS Code Tasks Abuse by Contagious Interview (DPRK) BeaverTail InvisibleFerret 2026-01-11 ⋅ Red Asgard ⋅ Red Asgard Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure BeaverTail InvisibleFerret 2025-12-17 ⋅ Recorded Future ⋅ Insikt Group PurpleBravo’s Targeting of the IT Software Supply Chain BeaverTail InvisibleFerret PylangGhost GolangGhost 2025-11-28 ⋅ OpenSourceMalware ⋅ OpenSourceMalware "Contagious Interview" campaign abuses Microsoft VSCode tasks to drop malware and gain persistence BeaverTail InvisibleFerret 2025-11-13 ⋅ NVISO Labs ⋅ Bart Parys, Efstratios Lontzetidis, Stef Collart Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery BeaverTail OtterCookie InvisibleFerret Beavertail TsunamiKit https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret Page 1 of 5 2025-10-20 ⋅ Medium Deriv-Tech ⋅ Shantanu Ghumade How a fake AI recruiter delivers five staged malware disguised as a dream job BeaverTail OtterCookie InvisibleFerret 2025-10-16 ⋅ Cisco Talos ⋅ Michael Kelley, Vanja Svajcer BeaverTail and OtterCookie evolve with a new Javascript module BeaverTail OtterCookie InvisibleFerret 2025-10-10 ⋅ Socket ⋅ Kirill Boychenko North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads BeaverTail InvisibleFerret 2025-09-25 ⋅ ESET Research ⋅ Matěj Havránek, Peter Kálnai DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception BeaverTail OtterCookie InvisibleFerret PylangGhost AkdoorTea GolangGhost Tropidoor TsunamiKit 2025-09-25 ⋅ Virus Bulletin ⋅ Matěj Havránek, Peter Kálnai DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception BeaverTail OtterCookie InvisibleFerret PylangGhost AkdoorTea GolangGhost Tropidoor TsunamiKit 2025-09-17 ⋅ GitLab ⋅ GitLab Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure BeaverTail OtterCookie BeaverTail InvisibleFerret Beavertail GolangGhost 2025-09-10 ⋅ ANY.RUN ⋅ ANY.RUN Lazarus Group Attacks in 2025: Here’s Everything SOC Teams Need to Know OtterCookie InvisibleFerret PylangGhost 2025-08-27 ⋅ Anthropic ⋅ Anthropic Anthropic - Threat Intelligence Report: August 2025 BeaverTail OtterCookie GolangGhost InvisibleFerret GolangGhost 2025-07-14 ⋅ Socket ⋅ Kirill Boychenko Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader BeaverTail InvisibleFerret 2025-06-24 ⋅ Socket ⋅ Socket Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages BeaverTail InvisibleFerret 2025-06-03 ⋅ ANY.RUN ⋅ ANY.RUN OtterCookie: Analysis of Lazarus Group Malware Targeting Finance and Tech Professionals BeaverTail OtterCookie InvisibleFerret https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret Page 2 of 5 2025-05-12 ⋅ ESET Research ⋅ ESET Research ESET APT Activity Report Q4 2024–Q1 2025 BeaverTail InvisibleFerret GolangGhost 2025-05-07 ⋅ NTT Security ⋅ Masaya Motoda, Rintaro Koike Additional Features of OtterCookie Malware Used by WaterPlum BeaverTail OtterCookie InvisibleFerret 2025-04-25 ⋅ HiSolutions ⋅ Maik Würth, Mateo Mrvelj, Nicolas Sprenger Rolling in the Deep(Web): Lazarus Tsunami InvisibleFerret tsunami TsunamiKit 2025-04-24 ⋅ Silent Push ⋅ Silent Push Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie BeaverTail OtterCookie FrostyFerret GolangGhost InvisibleFerret GolangGhost 2025-04-23 ⋅ Trend Micro ⋅ Feike Hacquebord, Stephen Hilt Russian Infrastructure Plays Crucial Role in North Korean Cybercrime Operations BeaverTail FrostyFerret GolangGhost InvisibleFerret GolangGhost WageMole 2025-04-11 ⋅ Bitso Quetzal Team ⋅ Mauro Eldritch Interview with the Chollima BeaverTail OtterCookie InvisibleFerret 2025-04-04 ⋅ Socket ⋅ Socket Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads BeaverTail InvisibleFerret 2025-02-20 ⋅ ESET Research ⋅ ESET Research DeceptiveDevelopment targets freelance developers BeaverTail InvisibleFerret 2025-02-13 ⋅ Recorded Future ⋅ Recorded Future Inside the Scam: North Korea’s IT Worker Threat BeaverTail OtterCookie InvisibleFerret 2025-02-07 ⋅ ⋅ SI-CERT ⋅ SI-CERT SI-CERT TZ016 / BeaverTail & InvisibleFerret BeaverTail InvisibleFerret 2025-02-05 ⋅ Bitdefender ⋅ Alina Bizga, Andrei ANTON-AANEI, Ionuț-Alexandru Baltariu Lazarus Group Targets Organizations with Sophisticated LinkedIn Recruiting Scam BeaverTail InvisibleFerret tsunami 2025-01-29 ⋅ Socket ⋅ Kirill Boychenko, Peter van der Zee North Korean APT Lazarus Targets Developers with Malicious npm Package https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret Page 3 of 5 BeaverTail InvisibleFerret 2025-01-29 ⋅ SecurityScorecard ⋅ SecurityScorecard STRIKE Team Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign BeaverTail InvisibleFerret 2024-12-24 ⋅ ⋅ NTT Security Holdings ⋅ NTT Security Holdings Contagious Interview Uses New Malware Otter Cookie BeaverTail OtterCookie InvisibleFerret 2024-11-26 ⋅ Arxiv ⋅ Alessio Di Santo Lazarus Group Targets Crypto-Wallets and Financial Data while employing new Tradecrafts BeaverTail InvisibleFerret tsunami TsunamiKit 2024-11-14 ⋅ eSentire ⋅ eSentire Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2 BeaverTail InvisibleFerret 2024-11-14 ⋅ Palo Alto ⋅ Unit 42 Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack BeaverTail InvisibleFerret WageMole 2024-11-04 ⋅ Zscaler ⋅ Zscaler From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West BeaverTail InvisibleFerret WageMole 2024-10-29 ⋅ SecurityScorecard ⋅ SecurityScorecard STRIKE Team The Job Offer That Wasn’t: How We Stopped an Espionage Plot BeaverTail InvisibleFerret 2024-10-29 ⋅ ⋅ Macnica ⋅ Hiroshi Takeuchi Job Offer from the North: Contagious Interview for Software Developers BeaverTail InvisibleFerret 2024-10-24 ⋅ Datadog ⋅ Datadog Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview BeaverTail InvisibleFerret 2024-10-17 ⋅ Github (ssrdio) ⋅ Gregor Spagnolo Analysis of BeaverTail & InvisibleFerret activity BeaverTail InvisibleFerret 2024-09-10 ⋅ Stacklok ⋅ Stacklok Dependency hijacking: Dissecting North Korea’s new wave of DeFi-themed open source attacks targeting developers BeaverTail InvisibleFerret https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret Page 4 of 5 2024-09-04 ⋅ Group-IB ⋅ Sharmine Low APT Lazarus: Eager Crypto Beavers, Video calls and Games BeaverTail BeaverTail InvisibleFerret Beavertail 2024-07-15 ⋅ Objective-See ⋅ Patrick Wardle This Meeting Should Have Been an Email: A DPRK stealer, dubbed BeaverTail, targets users via a trojanized meeting app BeaverTail BeaverTail InvisibleFerret 2023-11-21 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42 Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors BeaverTail InvisibleFerret WageMole There is no Yara-Signature yet. Source: https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret Page 5 of 5