Analyzing OtterCookie: The Node.js-Based Surveillance RAT Targeting Developer Workstations

A sophisticated new threat actor has emerged in the cybersecurity landscape: OtterCookie. Unlike many high-volume malware strains that focus on “smash-and-grab” data exfiltration, OtterCookie is designed for persistent, real-time surveillance, specifically targeting the high-value workstations of software developers.

Initial telemetry suggested a lineage shared with the known BeaverTail malware; however, deep forensic analysis has debunked this. OtterCookie is a distinct, Node.js-based Remote Access Trojan (RAT) characterized by a unique command-and-control (C2) architecture and a much more aggressive approach to continuous monitoring.

Architectural Shift: From Request-Response to Persistent Streams

Traditional malware often relies on standard HTTP/S polling, where the infected client periodically “checks in” with the server to receive instructions. OtterCookie breaks this pattern by leveraging Socket.IO powered by Engine.IO v4. This allows the malware to maintain a full-duplex, persistent WebSocket connection with the attacker’s infrastructure.

This architectural choice enables a “live broadcast” capability. Security researchers at Redasgard observed that the C2 infrastructure actively tracks victims and broadcasts a live roster of infected machines every few seconds. This effectively turns the attacker’s dashboard into a real-time monitor of active, online victims.

Forensic evidence linked this activity to a Hetzner-hosted server at 195.201.104.53. Technical analysis of the server revealed a multi-service environment:

• Port 6931: Actively broadcasted a live roster of infected devices, specifically targeting macOS systems associated with campaign IDs 902 through 906.
• Port 6101: An older, dormant service that no longer broadcast data, providing a digital footprint of previous infection waves.

Beyond Data Theft: The Surveillance Paradigm

While many Trojans are designed to harvest static files from a disk, OtterCookie functions as a specialized surveillance tool. It is optimized to observe active developer workflows. Its payload capabilities include:

• Input Capture: Keystroke logging and clipboard monitoring.
• Visual Intelligence: Periodic screen captures to observe the developer’s environment.
• Credential Harvesting: Extraction of browser-stored credentials, cryptocurrency wallet data, and critical developer secrets including SSH keys, .env files, cloud provider credentials, and API tokens.

This represents a strategic shift from BeaverTail (which targets stored data) toward a model of active observation. When paired with InvisibleFerret—a tool used to maintain long-term persistence—the attackers create a multi-layered infection chain designed for deep, long-term penetration into software supply chains.

Decoding the Metadata: Campaign IDs vs. Unique Identifiers

During the reverse-engineering process, researchers identified potential points of confusion in the malware’s telemetry. The fields labeled uid and userKey were initially suspected to be unique hardware identifiers (UUIDs). However, closer inspection revealed that multiple, unrelated machines often shared identical values for these fields.

In reality, these identifiers represent campaign batch IDs rather than unique device IDs. While this means defenders cannot use these specific fields to calculate an exact victim count, they serve as a vital forensic indicator to link disparate infections to specific, coordinated malware waves.

The Supply Chain Vector: npm and Vercel Exploitation

OtterCookie’s distribution strategy exploits the trust inherent in modern development workflows. Rather than relying on phishing, the campaign utilized supply chain attacks via malicious npm packages and payloads hosted on Vercel. This allows the malware to bypass traditional perimeter defenses by being “pulled” into the environment by the developer themselves during routine package installations.

Aggregated data from Socket.dev and The Hacker News suggests a massive scale for recent campaigns, with an estimated 197 malicious packages generating approximately 31,000 downloads during a single late-2025 wave.

Resilient Infrastructure: Separation of Concerns

One of the most impressive aspects of the OtterCookie infrastructure is its modularity. The attackers employ a “Separation of Concerns” design to ensure operational resilience:

1. The Control Plane: Manages live sessions, victim visibility, and real-time commands.
2. The Data Sink: Separate, write-only upload services designed solely to ingest stolen data.

By decoupling the monitoring (control) from the data collection (storage), the attackers ensure that even if a data-storage server is discovered and taken offline, the live monitoring of active victims remains uninterrupted. Furthermore, researchers identified a sibling variant known as “npoint,” which shares similar targets but utilizes a distinct command structure, suggesting parallel development within the same threat actor group.

Conclusion for Security Professionals

OtterCookie is a sobering reminder that as development environments become more integrated with the cloud, the “crown jewels” are no longer just files on a disk, but the active sessions and credentials used to access them. The move toward real-time, streaming malware requires a shift in defensive posture—moving away from static file scanning toward behavioral analysis and real-time network traffic monitoring for anomalous WebSocket activity.