WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

A North Korea-linked threat group known as WaterPlum has introduced a new malware strain called “StoatWaffle” as part of its ongoing Contagious Interview campaign.

The activity has been attributed to Team 8, a subgroup within WaterPlum also tracked as the Moralis or Modilus cluster.

This team was previously associated with the OtterCookie malware, but since December 2025, researchers have observed a clear shift toward this newly developed toolset.

The attack begins with a malicious repository disguised as a legitimate blockchain-related project. Within this repository, attackers include a hidden .vscode directory containing a specially crafted tasks.json file.

This file abuses the “runOn” configuration by setting its value to “folderOpen.” As a result, when a victim opens and trusts the repository in VSCode, a predefined task executes automatically without further interaction.

According to the report, the campaign continues to target developers, particularly those involved in blockchain projects, by abusing trusted development environments such as Visual Studio Code (VSCode).

This script performs environment checks and ensures persistence of the attack chain. It first verifies whether Node.js is installed on the system. If not, it downloads and installs Node.js from the official source, ensuring compatibility across different operating systems.

Once Node.js is available, the script downloads two additional files: env.npl and package.json. It then executes env.npl, marking the transition into the StoatWaffle malware framework.

StoatWaffle Loader Mechanism

The triggered task downloads payload data from a Vercel-hosted web application. The payload is executed via cmd.exe and acts as a simple downloader, retrieving a secondary script named vscode-bootstrap.cmd.

If the server responds with an error status, the returned content is treated as executable Node.js code.

After several minutes of polling, the loader receives a second-stage payload. This second downloader behaves similarly, but communicates with a different endpoint, “/api/handleErrors,” and continues executing commands delivered from the C2 server.

During analysis, researchers observed that the second stage quickly deploys both a stealer module and a remote access trojan (RAT), indicating a modular and flexible malware architecture.

The env.npl file serves as the initial loader for StoatWaffle. It establishes communication with a command-and-control (C2) server by polling the endpoint “/api/errorMessage” every five seconds.

The stealer module is designed to extract sensitive data from multiple sources. It targets credentials stored in web browsers and collects data from browser extensions.

For Chromium-based browsers, the malware gathers extension data alongside saved credentials. In Firefox environments, it parses the extensions.json file to identify targeted extensions based on specific keywords before extracting related data.

On macOS systems, the malware extends its reach to the Keychain database, further increasing the impact of the compromise.

Collected data is staged in temporary directories using randomized filenames and then uploaded to the C2 server via the “/upload” endpoint. Additionally, system profiling data, including installed software, is sent to a secondary endpoint, “/uploadsecond.”

A notable feature is its awareness of Windows Subsystem for Linux (WSL). If executed within a WSL environment, the malware converts Windows file paths into Linux-compatible paths using wslpath, enabling access to Windows user data from within a Linux context.

Remote Access Capabilities

The RAT module provides persistent control over the infected system. It continuously communicates with the C2 server, retrieving commands from “/api/hsocketNext” and sending execution results back to “/api/hsocketResult.”

This allows attackers to execute arbitrary commands, maintain long-term access, and expand their control over compromised environments.

The introduction of StoatWaffle highlights an evolution in WaterPlum’s tactics, particularly its focus on developer ecosystems and trusted tools like VSCode.

By embedding malicious configurations within seemingly legitimate repositories, attackers effectively bypass traditional security awareness.

This campaign underscores the increasing risk of supply chain attacks in development workflows, especially in high-value sectors like blockchain, where trust in shared code repositories is critical.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.