New 'OtterCookie' malware used to backdoor devs in fake job offers

North Korean operators running the ‘Contagious Interview’ campaign are targeting software developers with fake job offers and malicious Node.js/npm/Qt/Electron artifacts to deliver a new loader called OtterCookie. Introduced around September with a variant in November, OtterCookie uses Socket.IO for C2, executes remotely supplied JavaScript, and enables reconnaissance and exfiltration (including cryptocurrency private keys and clipboard data); it has been observed alongside BeaverTail and InvisibleFerret payloads.