TF-MAL-js.ottercandy
📛 Threat Title
Malware family: OtterCandy
Description
ThreatFox malware family `js.ottercandy`. Printable name: OtterCandy. Aliases: HardHatRAT,UNSEENMINK.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.ottercandy
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.ottercandy
IOC database
- Type
- domain
- Value
js.ottercandy- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.ottercandy
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.ottercandy
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cyberpress.org
The adoption of OtterCandy by Cluster B underscores a shift toward modular, language-agnostic malware that can be rapidly updated and deployed across operating systems. ClickFake Interview Its use within the well-established ClickFake Interview framework leverages social engineering and recruitment themes to lure victims into executing the malware .
-
web:cybersecuritynews.com
Cybercriminals associated with the North Korean threat group WaterPlum, also known as Famous Chollima or PurpleBravo, have escalated their activities with a sophisticated new malware strain called OtterCandy . This cross-platform RAT and information stealer represents a dangerous evolution in the group's capabilities, combining features from previously observed malware families RATatouille ...
-
web:cybersixt.com
N ORTH Korea's WaterPlum APT has evolved its OtterCandy malware , built with Node [.]js to function as both a Remote Access Trojan and an Information Stealer across Windows, macOS and Linux. According to NTT Security Japan, OtterCandy can steal browser credentials, cryptocurrency wallets and other confidential files, with the latest update in August 2025 refining persistence and data-theft ...
-
web:cyberwebspider.com
Cybercriminals related to the North Korean menace group WaterPlum, often known as Well-known Chollima or PurpleBravo, have escalated their actions with a classy new malware pressure known as OtterCandy . This cross-platform RAT and knowledge stealer represents a harmful evolution within the group's capabilities, combining options from beforehand noticed malware households RATatouille and ...
-
web:gbhackers.com
As WaterPlum's Cluster B refines its malware arsenal, defenders must adapt by integrating dynamic analysis into their security operations and fostering collaboration across industry peers. Ongoing close monitoring of OtterCandy's evolution will be vital to mitigating the next wave of ClickFake Interview assaults.
-
web:malpedia.caad.fkie.fraunhofer.de
OtterCandy is a JavaScript backdoor that uses the Socket.IO WebSocket protocol over port 5000 for command and control and exfiltrates data via HTTP on port 3011. It focuses on credential theft from Chromium-based browsers (Chrome, Edge, Brave, Opera, Yandex) by decrypting SQLite login databases with Windows DPAPI, and it targets cryptocurrency wallets through both browser extension ...
-
web:securityonline.info
A new report from NTT Security Japan has spotlighted an evolved malware family known as OtterCandy , attributed to the North Korea-linked group WaterPlum, also tracked as Famous Chollima or PurpleBravo. The campaign, recently observed targeting Japan, marks a sophisticated update in the group's multi-platform intrusion capabilities.
-
web:thehackernews.com
Contagious Interview Evolves with New OtterCandy Malware The disclosure comes as NTT Security Holdings shared details of a new malware called OtterCandy , deployed in connection with the Contagious Interview campaign since July 2025, targeting Windows, macOS, and Linux systems.
-
web:undercodenews.com
OtterCandy is a cross-platform Node.js RAT targeting multiple OS environments. Earlier versions of WaterPlum malware were not as sophisticated in exfiltrating complete browser profiles. Prediction: OtterCandy is likely to expand its geographic reach, targeting Southeast Asia and European organizations linked to Japanese business interests.
-
web:www.virusbulletin.com
WaterPlum, a North Korea-nexus threat group, has continued to use malware from the Otter family , including OtterCookie, since September 2024. To date, we have identified and analysed five malware variants: OtterPudding, OtterCookie, OtterCandy , OtterRusk, and OtterScone. Although these malware samples share a number of common characteristics, they differ in their detailed behaviour, C2 ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.