BeaverTail

ClickFix, which tricks users into following bogus prompts such as fake CAPTCHAs, and then infects victims' computers with trojanized codebases during the fake interview process.

A well-known North Korean threat actor has been caught hiding malware inside a legitimate PHP package available through Packagist... The package itself belongs to a legitimate maintainer named Drew Roberts, suggesting either a branch-level compromise or a poisoned workflow injection rather than a wholly fabricated fake package.

On November 29, 2024, a case was disclosed in which threat actors impersonated a recruitment email from a developer community called Dev.to to distribute malware. In this case, the attacker provided a BitBucket link containing a project... BeaverTail is known to be distributed primarily in phishing attacks disguised as job offers, such as the ones targeting LinkedIn users.

It can also quietly launch a second hidden process in the background using child_process.spawn() with the windowsHide flag set to true, keeping everything out of sight on Windows systems.

Once that obfuscated code runs, it quietly transforms into a full JavaScript malware loader operating inside Node.js... then runs the result directly inside Node.js using eval().

The malware sits quietly inside what looks like a standard Tailwind CSS configuration file... Once that obfuscated code runs, it quietly transforms into a full JavaScript malware loader operating inside Node.js.

The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.

They then tricked victims into cloning compromised repositories locally. As a result, the engineering workstations ran the malicious components seamlessly.

the specialized mc.so module installs trojanized browser extensions directly into Chrome and Brave. To achieve this goal, the malware explicitly targets extensions like MetaMask, Coinbase Wallet, and Phantom.

The harmful code is tucked away far to the right of the screen, hidden behind a large block of blank space that keeps it invisible during casual code review.

This component shuffles an extensive array of Base64 fragments during system initialization. Next, a specialized lookup function extracts these pieces using unique hexadecimal keys.

The project contained BeaverTail, a malware disguised as “tailwind.config.js,” and a downloader malware called “car.dll”.

Several entries explicitly state files were deleted after exfiltration or upload, such as 'AppleSeed can delete files from a compromised host after they are exfiltrated,' 'Attor’s plugin deletes the collected files and log files after exfiltration,' and 'Ursnif has deleted data staged in tmp files after exfiltration.' | The content repeatedly describes adversaries and malware deleting files, directories, droppers, scripts, logs, archives, staged data, and other artifacts from compromised systems, e.g., 'APT29 has used SDelete to remove artifacts from victim networks' and 'Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.'

The malware sits quietly inside what looks like a standard Tailwind CSS configuration file... Once that obfuscated code runs, it quietly transforms into a full JavaScript malware loader operating inside Node.js.

The loader uses hardcoded XOR keys to decrypt the material it retrieves and then runs the result directly inside Node.js using eval().

The updated BeaverTail variants now harvest critical credentials, private master keys, and seed phrases.

the delivered malware can read environment variables holding cloud credentials and CI secrets, grab local files such as .env files and SSH keys, access stored tokens

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

the delivered malware can read environment variables holding cloud credentials and CI secrets, grab local files such as .env files and SSH keys

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

This dead-drop method means there is no traditional command-and-control domain to block... it contacts public blockchain services, specifically TRON, Aptos, and BNB Smart Chain, to pull down encrypted payload data stored inside blockchain transaction records.

Instead, it contacts public blockchain services, specifically TRON, Aptos, and BNB Smart Chain, to pull down encrypted payload data stored inside blockchain transaction records.

ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.