BeaverTail and OtterCookie evolve with a new Javascript module

MITRE Techniques

• [T1543] Create or Modify System Process – Postinstall npm “scripts” value triggers execution of malicious code during package installation: “…npm run skip… node test/fixtures/eval…”
• [T1190] Exploit Public-Facing Application – Supply chain compromise via malicious NPM package “node-nvm-ssh” on npmjs and modified Bitbucket repository used to deliver payload: “…malicious npm package named ‘node-nvm-ssh’… modified Chessfi application hosted on Bitbucket…”
• [T1090] Proxy – Use of socket.io-client to communicate with C2, using HTTP then WebSocket on TCP port 1418: “…socket.io-client package used for communication with C2 server… listening on the TCP port 1418.”
• [T1056] Input Capture – Keylogging and clipboard theft via Node packages (“node-global-key-listener”, clipboard monitoring) capturing keystrokes and clipboard and saving to files “1.tmp” and “2.jpeg”: “…keylogger listens for the keyboard… saved in the user’s temporary sub-folder windows-cache with the file name ‘1.tmp’… clipboard monitoring… included…”
• [T1113] Screen Capture – Periodic desktop screenshots saved as “2.jpeg” and uploaded to C2 every four seconds: “…screenshot is taken every four seconds… screenshots are saved in the same sub-folder with the file name ‘2.jpeg’… uploaded to the OtterCookie C2 server…:1478/upload…”
• [T1071] Application Layer Protocol – Exfiltration and C2 over HTTP/HTTPS and custom ports (e.g., 1224, 1476, 1478, 5961) for uploading stolen data: “…hxxp[://]172[.]86[.]88[.]188:1476/upload… hxxp[://]23[.]227[.]202[.]244:1224/uploads… hxxp[://]138[.]201[.]50[.]5:5961/upload…”
• [T1083] File and Directory Discovery – File enumeration and targeted upload module that traverses drives and filters by name patterns and extensions to find sensitive files: “…enumerates all drives and traverses the file system… list of target file name extensions and file name search patterns…”
• [T1115] Clipboard Data – Clipboard theft using OS-native commands (“pbpaste”, “powershell Get-Clipboard”) to collect clipboard contents and send to C2: “…checks the clipboard content using the commands ‘pbpaste’ on macOS or ‘powershell Get-Clipboard’ on Windows… sends the clipboard content to the C2 server URL…/makelog”.
• [T1566] Phishing – Social engineering via fake job offers and deceptive development/interview lures (fake onboarding helper VS Code extension, Fiverr/Discord recruitment) used to convince victims to install malicious code: “…user was deceived by a fake job offer… likely approached… through the freelance marketplace site Fiverr… Discord conversations…”
• [T1027] Obfuscated Files or Information – Use of Obfuscator.io, base64 slicing and XOR schemes to hide C2 URLs and payloads: “…obfuscating the Javascript code… using different configurations of the free Javascript tool Obfuscator.io… encode the C2 URL as a shuffled string whose slices are base64 decoded… XOR-based obfuscation…”
• [T1218] System Binary Proxy Execution – Use of npm postinstall to run node child processes and eval of deobfuscated payload (test.list -> eval): “…file15.js reads and calls eval on the content of the file test.list… index.js spawning a child process to execute file15.js…”