North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens

North Korean-linked threat actors deployed malicious npm packages (notably gemini-ai-checker) that contain a fileless OtterCookie backdoor designed to steal AI tool tokens (Cursor, Claude, Gemini, Windsurf), browser credentials, crypto wallets and sensitive files. The malware uses a four-module architecture (RAT, credential stealer, file exfiltration, clipboard stealer), runs entirely in memory to evade detection, and the campaign remains active with multiple malicious packages observed.