OtterCookie Malware Steals Dev Secrets, SSH Keys, Cloud Credentials, and Tokens

A newly analyzed malware strain, OtterCookie, is emerging as a serious threat to developers, quietly harvesting sensitive data from active workstations in real time.

Unlike earlier assumptions, OtterCookie is not a variant of BeaverTail but a separate Node. js-based remote access trojan (RAT) with a different command-and-control design and a stronger focus on continuous surveillance.

Security researchers observed that OtterCookie operates over Socket.IO using Engine.IO v4, maintaining persistent connections with infected machines instead of relying on simple HTTP requests.

Its infrastructure actively tracks victims and broadcasts a live roster every few seconds, effectively allowing operators to monitor infected systems as they remain online.

This design marks a shift from traditional “request-response” malware toward a system that continuously streams activity.

The malware was linked to infrastructure hosted on a Hetzner server at 195.201.104.53, where multiple services were running simultaneously.

One service on port 6931 repeatedly broadcast a list of infected devices, including macOS systems tied to campaign IDs ranging from 902 to 906.

Another older service on port 6101 remained active but no longer broadcast data, suggesting earlier campaign activity.

Security researchers at Hunting Lazarus said in a report shared with GBhackers, OtterCookie operates over Socket.IO using Engine.IO v4, maintaining persistent connections with infected machines instead of relying on simple HTTP requests.

OtterCookie’s capabilities go far beyond one-time data theft. Instead of simply collecting stored files, it continuously monitors user behavior.

OtterCookie Malware Steals Dev Secrets

It captures clipboard content, records keystrokes, takes screenshots, and extracts browser credentials, crypto wallet data, and developer secrets such as SSH keys, environment files, cloud credentials, and API tokens.

This allows attackers to observe what a developer is doing in real time, including sensitive actions like logging into services or copying credentials.

This behavior contrasts sharply with BeaverTail, which focuses on harvesting already stored information. OtterCookie, by comparison, acts more like a surveillance tool, watching ongoing activity.

A third tool, InvisibleFerret, plays yet another role by maintaining persistence and enabling long-term access. Together, these tools form a layered attack chain targeting developers.

Researchers also identified a key misunderstanding in OtterCookie’s malware fields. Identifiers labeled “uid” and “userKey” initially appeared to represent individual victims. However, analysis showed that multiple unrelated machines often shared the same values.

This indicates these identifiers represent campaign batches rather than unique devices. In practice, this means defenders cannot rely on these fields to count victims, but they can use them to link infections to specific malware waves.

The malware’s reach expanded significantly through supply chain attacks. OtterCookie was distributed via malicious npm packages and Vercel-hosted payloads, targeting developers who may never have interacted with attackers directly.

Public reports from Socket.dev and The Hacker News estimate around 197 malicious packages and roughly 31,000 downloads during a late-2025 campaign wave.

Another important architectural detail is the separation of roles within the attacker infrastructure.

OtterCookie uses distinct systems for control, data collection, and delivery. The control plane manages live sessions and victim visibility, while separate upload services act as write-only sinks for stolen data.

This separation improves resilience, ensuring that monitoring remains active even if data storage systems change or rotate.

Researchers also uncovered a related variant known as “npoint,” which shares similar tooling and targets but uses a different command structure.

While it overlaps in functionality, its distinct communication patterns suggest it may be a parallel development rather than the same malware family.

OtterCookie highlights a growing trend in cyberattacks targeting developers, where real-time monitoring and credential harvesting can lead to deeper compromises across cloud environments and software supply chains.

Its ability to silently observe and extract sensitive data makes it particularly dangerous in modern development ecosystems.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.