SlowMist: North Korea's Lazarus is using a new stealing Trojan called OtterCookie to launch targeted attacks against encryption practitioners

According to the latest intelligence from the SlowMist security team, the North Korean Lazarus hacker group is using a new stealing Trojan called OtterCookie to launch targeted attacks against cryptocurrency and financial practitioners. The methods include faking high-paying job interviews/investor negotiations, using deepfake videos to impersonate recruiters, and disguising malware as "programming test questions" or "system update packages." The targets of theft include login credentials saved by browsers, passwords and digital certificates in macOS keychains, and encrypted wallet information and private keys. SlowMist recommends being vigilant about unsolicited job/investment offers, requiring multiple verifications for remote interviews, and never running executable files of unknown origin, especially so-called "technical test questions" or "update patches", strengthening terminal protection (EDR), deploying antivirus software, and regularly troubleshooting abnormal processes.