New “StoatWaffle” Malware Emerges in North Korean “Contagious Interview” Campaign

NTT Security Japan researchers discovered StoatWaffle, a Node.js-based modular malware used by North Korean-linked WaterPlum Team 8. The campaign uses malicious Git/VSCode repositories that auto-trigger a tasks.json task on folder open to download a bootstrap, install Node.js if needed, and deploy a downloader (env.npl) that launches modules for credential theft (browsers, extensions, macOS Keychain) and a RAT that persists and polls C2; the malware also converts Windows paths for access via WSL.