The FBI, CISA, and the State Department published a joint cybersecurity advisory naming the malware toolkit behind WaterPlum, also tracked as Contagious Interview, North Korea’s long-running campaign that uses fake recruiters and fabricated job interviews to get malware onto developers’ machines. The advisory names and describes six distinct malware families the operation now uses: BeaverTail, JavaScript-based malware hidden inside npm packages and downloadable from GitHub or Bitbucket; InvisibleFerret, a Python-based tool; OtterCookie, a JavaScript remote access trojan and infostealer; OtterCandy, which combines OtterCookie’s capabilities with RATatouille; and StoatWaffle, a modular Node.js family that bundles a loader, credential harvesting, and a RAT, delivered through blockchain-themed project repositories rigged with a malicious Visual Studio Code configuration that runs automatically when the folder is opened and trusted.
For security leaders, the advisory matters less for any single sample than for what the toolkit spread signals: North Korea is treating its fake-job pipeline as a platform, not a one-off lure, and is building malware specifically for the software ecosystems developers already trust by default, npm, PyPI-adjacent Python tooling, and VS Code project files. That is a harder population to protect with standard email and web filtering, since the infection point is a job interview, a coding exercise, or a cloned repository rather than a phishing attachment. CyberTech has previously covered Lazarus pairing fake job offers with a Windows zero-day and North Korean job fraud expanding into healthcare and sales roles, and this advisory shows the same fraudulent-hiring playbook now paired with a purpose-built, multi-language malware family rather than a single implant.
The detail worth flagging for defenders is StoatWaffle’s use of VS Code’s auto-run behavior on trusted folders: it turns a routine step in technical hiring, cloning and opening a candidate repository, into unattended code execution. Security and HR teams running technical interviews should treat any externally supplied repository as untrusted code until scanned, regardless of how convincing the recruiting process looks.
