InvisibleFerret Malware Now Ships as .pyd and .so Files to Evade Script Detection

InvisibleFerret, an info-stealer tied to the North Korea-linked Void Dokkaebi (Famous Chollima), has been reworked from Python scripts into Cython-compiled native modules (.pyd on Windows, .so on macOS) to evade script-based detection; the campaign uses social engineering against developers to deliver multi-stage infections, and an expanded BeaverTail loader now provides additional credential- and wallet-stealing capabilities and trojanized browser extensions, with multiple IoCs and recommended detection changes provided by analysts.