INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

WeaselBiscuit strips BeaverTail and OtterCookie via browser exploit vector

| 2026-09-21 02:35 CRITICAL HIGH PHISHING & SOCIAL ENGINEERING FRAUD & CRYPTO THEFT
JSON
Executive Summary
AI-generated
On September 21, 2026, a new JavaScript stealer malware was discovered in 11 secretly hidden npm packages. The malware resembles the DPRK's BeaverTail and OtterCookie but is smaller and stripped down with fewer functions. It targets cryptocurrency trading websites using a variation of ClickFix social engineering attacks, convincing users to paste malicious code into their browser session or install it through Tampermonkey. This campaign began in early October 2025 and has been observed distributing lures through Telegram, DarkForums, and paste sites. The malware injects counterfeit "bonus" interface elements, hooks the fetch API, replaces cryptocurrency deposit addresses, and displays fake bonus messages.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation.
Technical Observables 9 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 9 IoCs Create Free Account
domains 4 urls 3 sha256 1 md5 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
BeaverTailBeaverTail
Target & Sectors
DPRK DPRK cryptocurrencycryptocurrency technologytechnology
Incident Timeline
‎2026/09/21
Threat actors used the Google Visualization API to retrieve and inject malicious JavaScript into two cryptocurrency trading websites, stealing Bitcoin from victims.
organisation OtterCookie
It looks and feels like the DPRK’s BeaverTail and OtterCookie, but it isn’t quite either one.
organisation IOC - WeaselBiscuit Strips
IOC - WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials.
financial $10,000 $ BTC
Of these, 24 received funds from victims of the scheme, totalling 0.159 BTC (approximately $10,000 at early August 2026 valuations of Bitcoin).
threat_actor TeamPCP
With a rise in supply-chain attacks by groups such as TeamPCP, which has sold access to other cybercriminals, the methods used in this cryptocurrency-stealing campaign could be used to leverage stolen access across large numbers of web applications…
Tactical Metrics
Metrics
financial
10,000
$ Btc
Of these, 24 received funds from victims of the scheme, totalling 0.159 BTC (approximately $10,000 at early August 2026 valuations of Bitcoin).
Intelligence Sources
Talos Intelligence 2026-09-08
AlienVault OTX 2026-09-21