TF-MAL-js.beavertail

Description

ThreatFox malware family `js.beavertail`. Printable name: BeaverTail.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• BeaverTail Variant via Malicious Repositories Targeting Retail Sector ...
  web:advisory.eventussecurity.com

  Once executed, the payload retrieves BeaverTail , a JavaScript-based malware traditionally disguised in job-related repositories, but here delivered as compiled binaries via packaging tools like PyInstaller. This modification drastically reduced static detection rates, although network behavior remained detectable.

  2026-05-22 05:25 UTC
• BeaverTail, Software S1246 | MITRE ATT&CK®
  web:attack.mitre.org

  BeaverTail BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview.

  2026-05-22 05:25 UTC
• BeaverTail Malware Variant Exploiting Repositories to Target Retail Sector
  web:cyberpress.org

  BeaverTail malware - North Korean nation-state operators tracked as Contagious Interview and Famous Chollima have refined their BeaverTail .

  2026-05-22 05:25 UTC
• BeaverTail Variant via Malicious Repositories Targeting Retail Sector ...
  web:cybersecuritynews.com

  A sophisticated North Korean nation-state threat actor campaign has emerged, distributing an evolved variant of the BeaverTail malware through deceptive fake hiring platforms and ClickFix social engineering tactics. This latest campaign, active since May 2025, represents a significant tactical shift as threat actors expand beyond their traditional software developer targets to pursue marketing ...

  2026-05-22 05:25 UTC
• BeaverTail Malware Delivered Through Malicious Repositories Targets ...
  web:gbhackers.com

  Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure 17 September 2025 - Oliver Smith, GitLab Threat Intelligence We have identified infrastructure distributing BeaverTail and InvisibleFerret malware since at least May 2025, operated by North Korean actors tracked as Contagious Interview and Famous Chollima. The campaign uses ClickFix lures to target ...

  2026-05-22 05:25 UTC
• Tech Note - BeaverTail variant distributed via malicious repositories ...
  web:gitlab-com.gitlab.io

  Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure 17 September 2025 - Oliver Smith, GitLab Threat Intelligence Key Points We've identified infrastructure used to distribute BeaverTail and InvisibleFerret malware variants since at least May 2025. BeaverTail and InvisibleFerret are malware families operated by North Korean nation-state threat actors ...

  2026-05-22 05:25 UTC
• Beavertail (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the Beavertail malware family including references, samples and yara signatures.

  2026-05-22 05:25 UTC
• DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams
  web:thehackernews.com

  DPRK used ClickFix to deliver compiled BeaverTail to crypto marketers; Windows build used password-protected archives, revealing a tactical shift.

  2026-05-22 05:25 UTC
• Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers ...
  web:unit42.paloaltonetworks.com

  The malware authors compiled BeaverTail variants for both Windows and macOS from the same source code using the Qt programming language. North Korean threat actors are known to conduct financial crimes for funds to support the DPRK regime.

  2026-05-22 05:25 UTC
• Beavertail and InvisibleFerret malware | Travis Mathison
  web:www.travismathison.com

  The adversary uses custom malware families BeaverTail and InvisibleFerret, remote monitoring and management tools (RMMs), and malicious Node.js applications to deliver malware to victims. They also infiltrate corporate environments through malicious insiders, often hired as full-time equivalents directly or via contracting organizations.

  2026-05-22 05:25 UTC

Only Available for Registered Users. Sign in to view.