Cross-platform malware and downloader used by North Korean state hackers to steal data from developers, IT staff and crypto users since 2022.
OpenSourceMalware says WeaselBiscuit borrows functions from DPRK's BeaverTail and OtterCookie but strips out the persistence and the wallet drainer. It runs from memory on an npm import and takes Chrome's extension storage.
Reality
Four governments have put a bureau name on the fake-recruiter campaign against software developers, and their alert says the same crews also work as North Korea's remote IT hires, from the same IP addresses.
Perspective Coverage
8 publishersReality
Japan, the US, Australia and Germany put eight months of North Korea's developer-targeting campaign at $10.71 million taken from more than 7,000 wallets. CertiK counted $2.06 billion of North Korea-linked crypto theft in 2025 alone.
Reality
A joint advisory ties about $10.71 million of stolen cryptocurrency to more than 30,000 infected devices in over 100 countries. That works out near $357 a machine, and the payroll half of the same operation ran for years.
Reality
Seven agencies across four countries tied fake recruiters and take-home coding tasks to eight months of infections and drained cryptocurrency wallets.
Reality