Lazarus Group Embed New BeaverTail Variant in Developer Tools
ID: 625a0503-ec37-5c1f-8089-690709b90f29
STIX ID: report--625a0503-ec37-5c1f-8089-690709b90f29
Feed Name: HackRead
Threat Score
Darktrace reported a highly obfuscated V5 variant of the BeaverTail JavaScript information stealer—attributed to Lazarus-linked clusters—that is distributed via fake job interviews and trojanized developer packages (npm, VS Code extensions), operates cross‑platform, records keystrokes and screenshots, exfiltrates credentials and crypto keys, and uses blockchain-based 'EtherHiding' to hide commands and resist takedowns.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.