OtterCookie
- First seen
- 2022-06-15 00:00:00
- Malware type
- credential-stealer, spyware
- Last IoC activity
- 2026-07-21 16:42:41
- Profile updated
- 2026-07-07 13:15:07
Targeted industries: financial-services government-and-public-sector
Targeted regions: country_code:us
Context
OtterCookie is a credential-stealing malware known for targeting financial services and government sectors primarily in the United States. It operates as spyware, collecting sensitive information from infected systems.
Reports & references
- jp.security.ntt — En Waterplum Ottercookie (report)
- about.gitlab.com — Gitlab Threat Intelligence Reveals North Korean Tradecraft (report)
- Microsoft — Contagious Interview Malware Delivered Through Fake Developer Job Interviews (report)
- recordedfuture.com — Inside The Scam North Koreas It Worker Threat (report)
- blog.nviso.eu — Contagious Interview Actors Now Utilize Json Storage Services For Malware Delivery (report)
- www-cdn.anthropic.com — B2A76C6F6992465C09A6F2Fce282F6C0Cea8C200 (report)
- jp.security.ntt — Contagious Interview Ottercookie (report)
- ESET — Deceptivedevelopment From Primitive Crypto Theft To Sophisticated Ai Based Deception (report)
- gitlab-com.gitlab.io — North Korean Malware Sept 2025 (report)
- medium.com — How A Fake Ai Recruiter Delivers Five Staged Malware Disguised As A Dream Job 64Cc68Fec263 (report)
- silentpush.com — Contagious Interview Front Companies (report)
- Cisco Talos — Beavertail And Ottercookie (report)
- quetzal.bitso.com — Interview With The Chollima (report)
- any.run — Ottercookie Malware Analysis (report)
- virusbulletin.com — Deceptivedevelopment And North Korean It Workers From Primitive Crypto Theft To Sophisticated Ai Based Deception (report)
- jp.security.ntt — En Waterplum Ottercookie (report)
- malpedia.caad.fkie.fraunhofer.de — Js.Otter Cookie (report)
- Microsoft — Ai As Tradecraft How Threat Actors Operationalize Ai (report)
- jp.security.ntt — En Contagious Interview Ottercookie (report)
- any.run — Lazarus Group Attacks 2025 (report)
- gbhackers.com — Lazarus Group Malware With Ottercookie (report)
- blackpointcyber.com — Malicious Node Package Deploys Ottercookie (report)
- cyberandramen.net — Ottercookie Expands Targeting To Ai Coding Tools Analysis Of A Trojanized Npm Campaign (report)
- blog.daviddodda.com — How I Almost Got Hacked By A Job Interview (report)