FlagThis - #chrome

The North Korean threat actor WaterPlum, also known as Famous Chollima or PurpleBravo, is behind the latest iteration of the OtterCookie malware, version 4. This cross-platform malware is designed to target financial institutions, cryptocurrency platforms, and FinTech companies across the globe. OtterCookie's evolution demonstrates a significant advancement in its capabilities, posing an increased threat level. The malware is often deployed through the "Contagious Interview" campaign, which uses fake job offers to entice victims into opening malicious payloads.

OtterCookie v4 boasts enhanced credential theft capabilities, with modules specifically designed to steal credentials from Google Chrome, MetaMask, and iCloud Keychain. One module decrypts and extracts passwords from Chrome using the Windows Data Protection API (DPAPI), while another targets the MetaMask extension in browsers like Chrome and Brave, as well as iCloud Keychain, to harvest sensitive data. These stolen credentials are then stored in a local database before being exfiltrated. These advancements represent a significant leap from earlier versions of OtterCookie which primarily functioned as a file grabber.

A key feature of OtterCookie v4 is its ability to detect virtual machine environments, including VMware, VirtualBox, Microsoft Hyper-V, and QEMU. This allows the malware to evade analysis and detection by security researchers and automated sandbox environments. The malware's cross-platform functionality allows it to operate across Windows, macOS, and Linux, significantly broadening its potential impact. Researchers first exposed OtterCookie in December 2024, and the malware has rapidly evolved since then, with version 3 appearing in February 2025 and version 4 in April 2025.


References :

• MeatMutts: OtterCookie v4 Adds VM Detection and Chrome, MetaMask Credential Theft Capabilities
• Anonymous ???????? :af:: Security’s Masaya Motoda & Rintaro Koike detail the key differences between the OtterCookie malware variants used by WaterPlum (Famous Chollima/PurpleBravo) in November 2024 and in February and April 2025, highlighting their chronological evolution.
• securityonline.info: WaterPlum’s OtterCookie Malware Upgrades to v4 with Credential Theft and Sandbox Detection Features
• Anonymous ???????? :af:: NTT Security - OtterCookie Malware variants by WaterPlum
• Anonymous ???????? :af:: Security’s Masaya Motoda & Rintaro Koike detail the key differences between the OtterCookie malware variants used by WaterPlum (Famous Chollima/PurpleBravo) in November 2024 and in February and April 2025, highlighting their chronological evolution.
• securityonline.info: Information on new malware OtterCookie

Classification:

• HashTags: #OtterCookie #NorthKorea #Malware
• Company: North Korean
• Target: Financial institutions, cryptocurrency platforms
• Attacker: WaterPlum
• Product: Chrome
• Feature: Credential Theft
• Malware: OtterCookie
• Type: Malware
• Severity: Major

Cybercriminals are increasingly using sophisticated tactics to deceive individuals and steal sensitive information. One common method involves sending fraudulent text messages, known as smishing, that impersonate legitimate businesses like delivery services or banks. These scams often entice victims to click on malicious links, leading to identity theft, financial loss, or the installation of malware. Webroot emphasizes mobile security, particularly protecting phones from text scams with potential identity theft and malware planting. The Federal Trade Commission reported that consumers lost $470 million to scams initiated through text messages in 2024.

Google is intensifying its efforts to combat these online threats by integrating artificial intelligence across its various platforms. The company is leveraging AI in Search, Chrome, and Android to identify and block scam attempts more effectively. Google's AI-powered defenses are capable of detecting 20 times more scam pages than before, significantly improving the quality of search results. Furthermore, AI is used to identify fraudulent websites, app notifications, calls, and direct messages, helping to safeguard users from various scam tactics.

A key component of Google's enhanced protection is the integration of Gemini Nano, a lightweight, on-device AI model, into Chrome. This allows for instant identification of scams, even those that haven't been previously encountered. When a user navigates to a potentially dangerous page, Chrome evaluates the page using Gemini Nano, which extracts security signals to determine the intent of the page. This information is then sent to Safe Browsing for a final verdict, adding an extra layer of protection against evolving online threats.


References :

• www.eweek.com: Google is intensifying efforts to combat online scams by integrating artificial intelligence across Search, Chrome, and Android, aiming to make fraud more difficult for cybercriminals.
• www.webroot.com: It all starts so innocently. You get a text saying “Your package couldn’t be delivered. Click here to reschedule.†Little do you know, clicking that link could open the door for scammers to steal your identity, empty your bank account, or even plant malicious software (malware) on your device. Unless you know what to look out

Classification:

• HashTags: #MobileSecurity #AIScamDetection #Cybersecurity
• Company: Webroot
• Target: Mobile users
• Product: Chrome
• Feature: Mobile Security
• Type: Security
• Severity: Medium