New BeaverTail Malware Variant Linked to Lazarus Group

Darktrace reports a hyper-obfuscated BeaverTail JavaScript malware variant linked to DPRK/Lazarus actors that functions as an infostealer and loader targeting cryptocurrency traders, developers and retail employees. Delivered via trojanized npm packages, fake job-assessment platforms and social-engineering lures, the cross-platform framework collects host and credential data, fetches additional payloads, and has been observed merged with OtterCookie to enhance wallet targeting, persistence and surveillance.