7 minhigh
WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
WeaselBiscuit is a lean DPRK-suspected npm infostealer stealing Chrome extension data, clipboard, and keystrokes via plain HTTP C2, stripped from BeaverTail/OtterCookie lineage. Eleven malicious npm packages deliver WeaselBiscuit, a Node.js infostealer that fetches in-memory payloads from Npoint dead-drops and beacons to a shared HTTP C2. It steals Chrome extension storage, clipboard, and Windows keystrokes but lacks wallet-draining, password decryption, and remote shell capabilities found in BeaverTail/OtterCookie.
Sens:■ ImmediateConf:high
IOCs15
7url4npm package2file path1ip1sha256
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block 103.170.217.184 on network egress and proxy filters.
- Remove all listed npm packages from registries and local caches.
- Hunt for api.npoint.io requests and .pid files on developer endpoints.
- Quarantine endpoints with %TEMP%\kb-monitor\ directories.
Key Takeaways
- Eleven npm packages identified; process-tailwind and engin1 share byte-identical loader code.
- Numeric campaign IDs (10, 12, 44, 79, 95, 99) embedded in package names and stage uploads.
- Payload executes in memory via Base64 decode and new Function(), never touching disk.
- All recovered stages share one C2 config resolver yielding 103.170.217.184:8787.
- Windows keylogger drops PowerShell script to %TEMP%\kb-monitor\keyboard-monitor-*.ps1.
Attack Chain
- Initial Access: Malicious npm packages imported by developer applications
- Execution: Detached Node.js loader spawned, PID stored in .pid file
- Defense Evasion: Payload fetched from Npoint, Base64-decoded, executed in memory via new Function
- Discovery: Host profiled for hostname, OS, user, hardware, IP, geolocation
- Collection: Chrome extension storage, clipboard, and Windows keystrokes exfiltrated
- C2: Polling HTTP to Express C2 at 103.170.217.184:8787 every 5 seconds
Affected Systems
- Windows, macOS, and Linux (Chrome extension theft)
- Windows specifically (keylogging capability)
- Node.js environments importing npm packages
- Chrome browser users with installed extensions
- Developer workstations and CI/CD pipelines
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Detached Node process and .pid file are visible; in-memory new Function execution and legitimate npm context complicate detection. |
| Network Visibility | High | Plain HTTP to Npoint and C2 IP with distinctive API route paths; no encryption or domain fronting. |
| Detection Difficulty | Moderate | Clear network indicators and C2 routes; endpoint detection harder due to legitimate Node.js context and in-memory execution. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Node.js processes making HTTP requests to api.npoint.io followed by dynamic code execution via new Function (T1059.007, T1620, T1105) | Process network connections and script block logging | Execution | Low — api.npoint.io is uncommon in enterprise dev environments |
| Node.js processes reading Chrome Local Extension Settings directories and uploading files via multipart POST (T1005, T1071.001) | File access events and network POST body inspection | Collection | Medium — legitimate browser automation tools may access extension data |
| PowerShell processes executing scripts from %TEMP%\kb-monitor\ directory on Windows endpoints (T1059.001, T1056.001) | Process command line and file path events | Collection | Low — kb-monitor path is non-standard for legitimate tooling |
| HTTP polling to /api/clipboard-status/ or /api/keyboard-mouse-status/ endpoints on external IPs every 5 seconds (T1071.001) | Network flow and HTTP proxy logs | Command and Control | Low — distinctive route paths with external IP destination |
Required Log Sources
- Process creation events (Sysmon EID 1)
- Network connection events (Sysmon EID 3)
- DNS resolution logs
- HTTP proxy logs
- File creation events (Sysmon EID 11)
- npm install logs
Key Behavioral Indicators
- Detached node.exe processes spawned with stdio:'ignore'
- .pid files created in npm package directories
- Base64-decoded JavaScript executed via new Function() in Node
- HTTP requests to api.npoint.io from node.exe processes
- Chrome Local Extension Settings directory access by Node processes
- PowerShell scripts executing from %TEMP%\kb-monitor\
Control Gaps
- Application allowlisting does not block npm package imports
- Network filtering may not block api.npoint.io as a legitimate service
- In-memory execution via new Function evades file-based scanning
- Detached Node process blends with legitimate developer activity
- Chrome extension storage access by Node processes is not typically alerted
False Positive Assessment
Low — Npoint URLs, C2 IP, specific npm package names, and distinctive API route paths are high-fidelity indicators with minimal legitimate use.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block egress to api.npoint.io from non-browser processes.
- Implement npm package allowlisting in CI/CD pipelines.
- Enable npm audit and package provenance verification.
- Monitor for HTTP traffic on port 8787 to external IPs.
User Protection
- Remove listed npm packages from developer workstations.
- Rotate credentials and wallet states if packages were installed.
- Isolate developer machines that imported any listed packages.
Security Awareness
- Train developers to verify npm package provenance before import.
- Review package maintainer accounts and download history for anomalies.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Execution
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Plain-Language Summary
A new malware called WeaselBiscuit was found hidden inside npm packages (software libraries that developers download). When a developer imports one of these packages, the malware secretly runs, steals data from Chrome browser extensions (including cryptocurrency wallet data), and can capture clipboard contents and keystrokes. It is suspected to be linked to North Korean hackers but this is not confirmed. Organizations should check if any of the listed packages are in use and remove them.
Additional IOCs
- Urls:
hxxps://api[.]npoint[.]io/ddae72efbb6714fae922- Stage 1 payload resolver for campaign ID 12hxxps://api[.]npoint[.]io/933a731a5e97f4b45249- Stage 1 payload resolver for campaign ID 95hxxps://api[.]npoint[.]io/24c12c4b66a29747764f- Stage 1 resolver hard-coded by id79-client; returned HTTP 404
- File Paths:
%TEMP%\kb-monitor\keyboard-monitor-*.ps1- PowerShell keylogger script dropped on Windows<package-directory>/.pid- PID marker file for detached Node loader process
- Command Lines:
- Purpose: Spawn detached Node.js loader process with suppressed I/O | Tools:
node| Stage: Execution |node loader.js - Purpose: Execute Windows keylogger PowerShell script from temp directory | Tools:
powershell| Stage: Collection |%TEMP%\kb-monitor\
- Purpose: Spawn detached Node.js loader process with suppressed I/O | Tools:
- Other:
@biz44/id10-client- Malicious npm package, campaign ID 10@biz44/id12-client- Malicious npm package, campaign ID 12@biz44/id44-client- Malicious npm package, campaign ID 44@biz44/id79-client- Malicious npm package, campaign ID 79@biz44/id95-client- Malicious npm package, campaign ID 95@biz44/id99-client- Malicious npm package, campaign ID 99@biz44/process-runtime-utils- Malicious npm package in @biz44 cluster@biz44/runtime-utils- Malicious npm package in @biz44 cluster@railone/image-utils- Malicious npm package, first seen unknown@vibecheck-polid/process-runtime-utils- Malicious npm package, first seen unknownlaycot- Malicious npm package (v1.3.10 still on NPM)process-lhpm- Malicious npm package, first seen 2026-09-15process-mite- Malicious npm package, first seen 2026-09-16
Showing defanged values
- file_path<package-directory>/.pidPID marker file for detached Node loader process
- file_path%TEMP%\kb-monitor\keyboard-monitor-*.ps1PowerShell keylogger script dropped on Windows
- ip103[.]170[.]217[.]184Shared HTTP C2 server for all recovered WeaselBiscuit stages
- npm_packageengin1Confirmed malicious npm loader, byte-identical to process-tailwind (v1.3.99)
- npm_packageid79-clientConfirmed malicious npm loader package (v1.1.79)
- npm_packageprocess-tailwindConfirmed malicious npm loader package (v1.1.99)
- npm_packageswnwallConfirmed malicious npm loader package (v1.2.10)
- sha2567b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159Second-stage in-memory payload delivered by Npoint resolver
- urlhxxps://api[.]npoint[.]io/24c12c4b66a29747764fStage 1 resolver hard-coded by id79-client; returned HTTP 404
- urlhxxps://api[.]npoint[.]io/24c25d5f5fcbb0992a4fStage 1 payload resolver for campaign ID 99 (process-tailwind)
- urlhxxps://api[.]npoint[.]io/33e8d008c334b060adadStage 1 payload resolver for campaign ID 79
- urlhxxps://api[.]npoint[.]io/37c0a0c68bf7a94ed731Shared C2 configuration resolver for all recovered stages
- urlhxxps://api[.]npoint[.]io/641d37178a880b1e8b8fStage 1 payload resolver for campaign ID 10 (swnwall)
- urlhxxps://api[.]npoint[.]io/933a731a5e97f4b45249Stage 1 payload resolver for campaign ID 95
- urlhxxps://api[.]npoint[.]io/ddae72efbb6714fae922Stage 1 payload resolver for campaign ID 12