This week, Tanium’s Cyber Threat Intelligence (CTI) team explores a new evolution in the BeaverTail and OtterCookie malware families. Next, the team looks at three new malware families tied to the Russian state-sponsored group COLDRIVER. Finally, we wrap up with an overview of Vidar Stealer 2.0.
Famous Chollima combines BeaverTail and OtterCookie into new JavaScript malware
Cisco Talos has uncovered an evolution in the BeaverTail and OtterCookie malware families, which are both linked to Famous Chollima, an advanced persistent threat (APT) group aligned with the North Korean government and known for frequently targeting job seekers.
This latest campaign involves the deployment of a new JavaScript module designed to enhance the malware’s capabilities and stealth.
OtterCookie keylogging and screenshot module
The researchers at Cisco Talos discovered a keylogging and screenshot module in the Famous Chollima campaign that hadn’t been reported before. They also identified OtterCookie samples with this module on VirusTotal from April 2025.
This module can log keystrokes, take desktop screenshots, and send the data to the OtterCookie command-and-control (C2) server. The malware saves keystrokes and screenshots in a temporary subfolder before sending them.
OtterCookie Visual Studio Code extension
Cisco Talos also found a Visual Studio (VS) Code extension that tried to run OtterCookie. The extension poses as an employment onboarding tool. Researchers can’t confirm attribution to the actor but believe it may indicate experimentation with new delivery methods.
Additional OtterCookie modules
Cisco Talos uncovered several additional OtterCookie modules during the research. These include:
- Remote shell module
- File upload module
- Cryptocurrency extension stealer module
The report contains more details about each module.
OtterCookie evolution
OtterCookie malware first appeared in late 2024. In April 2025, Cisco Talos began seeing new modules included that made the malware modular instead of basic.
In August 2025, Cisco Talos observed the latest version, referred to as v5. This release introduced a keylogging module and, when deobfuscated, revealed that the codebase combines elements of both OtterCookie and BeaverTail.
BeaverTail functionality
The BeaverTail code can enumerate browser profiles and extensions, download a Python distribution and client payload from its C2 server, and disable console logging before loading modules.
BeaverTail has been active since at least May 2023. It started as a small downloader in JavaScript applications and appeared in malicious npm packages as part of software supply chain attacks.
The malware can also download the InvisibleFerret Python stealer payload modules.
Analyst comments from Tanium’s Cyber Threat Intelligence team
APT groups like Famous Chollima are now adopting agile development principles in malware design. This allows them to rapidly iterate, test, and deploy new capabilities without overhauling their entire infrastructure, which mirrors modern software engineering practices.
This actor’s continued reliance on spear phishing and fake job sites proves how threat actors are continuing to exploit human vulnerabilities, making user awareness and training critical.
COLDRIVER deploys three new malware families
Google’s Threat Intelligence Group (GTIG) recently uncovered three new malware families linked to COLDRIVER, a Russian state-sponsored group. The new malware is being used in targeted phishing campaigns and demonstrates an increase in development and operational tempo for this threat group.
Google found that this actor’s re-tooling started with a new malicious DLL called NOROBOT. It was delivered via a CAPTCHA-themed ClickFix lure in a manner similar to previous COLDRIVER attacks. NOROBOT originally deployed a backdoor called YESROBOT, but Google has noticed that the actor pivoted away from this backdoor to a different backdoor tracked as MAYBEROBOT.
The latest infection chain involves three different components that are delivered via a COLDCOPY ClickFix lure. With this lure, the user is tricked into downloading and executing a DLL using rundll32 after being asked to verify they are not a robot.
NOROBOT, YESROBOT, and MAYBEROBOT
- NOROBOT (also referred to as BAITSWITCH) is a DLL that has been under development for a few months. Its main goal is to obtain the next stage from the C2. NOROBOT will fetch and extract a Python 3.8 installation, which Google notes is “a noisy artifact that is likely to raise suspicions.” NOROBOT will also establish persistence using a scheduled task.
- YESROBOT is a Python backdoor that retrieves command from its C2. It requires all commands to be in valid Python, which limits functionality and made it cumbersome to operate. GTIG observed only two instances of YESROBOT and believes it was likely abandoned for MAYBEROBOT.
- MAYBEROBOT (also referred to as SIMPLEFIX) does not require Python to execute and uses a custom protocol supporting three commands: download and execute files, run
cmd.execommands, and execute PowerShell blocks. While an improvement, MAYBEROBOT still has “minimal built-in functionality.”
Analyst comments from Tanium’s Cyber Threat Intelligence team
COLDRIVER’s swift pivot to new malware families demonstrates a high level of agility and preparedness, suggesting a well-resourced and experienced threat actor capable of maintaining persistent access.
The further evolution from YESROBOT to MAYBEROBOT shows a deliberate trade-off between ease of deployment and operational flexibility, highlighting the group’s nuanced understanding of detection evasion and long-term access.
Vidar Stealer 2.0 demonstrates upgraded capabilities
According to Trend Micro, the latest Vidar Stealer 2.0 marks a significant evolution of the infostealer malware. This version introduces architectural changes and advanced techniques designed to improve performance, expand data theft capabilities, and evade detection.
What is Vidar infostealer?
The Vidar infostealer first emerged in 2018, originally based on the Arkei stealer source code, and was known for stealing browser credentials and cryptocurrency wallets.
Since its emergence, Vidar has steadily expanded its capabilities. And in October 2025, its developer announced Vidar 2.0: a significant overhaul aimed at boosting performance and evasion against modern defenses.
Vidar 2.0 updates
Vidar 2.0 contains several changes, including a complete rewrite from C++ to C. The Vidar developer also claims that the malware now comes with a multithreading system to “allow extremely efficient use of multi-core processors” while making the overall data collection process faster. Trend Micro found that the advanced multithreading system can automatically adjust the performance based on each victim’s computer specifications, scaling thread count dynamically.
What’s more, the new version of Vidar 2.0 uses unique AppBound bypass methods, such as memory injection techniques, to defeat Chrome’s application-bound encryption. These methods also apply to Chrome, Firefox, Edge, and other Chromium-based browsers.
Another big change is the addition of an automatic polymorphic builder (morpher), which means that every build of the malware is unique and has different binary signatures.
Vidar 2.0 technical details and execution flow
According to Trend Micro, “Vidar 2.0's execution flow reveals a carefully orchestrated sequence of operations designed to maximize data collection while evading detection through advanced anti-analysis techniques, multithreaded processing, and adaptive evasion mechanisms.”
- Initialization and evasion: Vidar’s initialization phase establishes a multithreaded architecture and applies control flow obfuscation. In the evasion phase, it performs anti-analysis checks such as debugger detection, timing verification, system uptime validation, and hardware profiling to avoid executing in sandbox environments.
- Intelligence gathering and data theft: Next, the malware performs system profiling before gathering credentials and other sensitive data.
- Exfiltration and cleanup: Towards the end of the attack, the malware captures screenshots before packaging and exfiltrating the gathered data via HTTP multipart for submissions to its C2, leveraging Telegram bots and Steam profiles as additional channels. The malware also cleans up temporary artifacts.
Analyst comments from Tanium’s Cyber Threat Intelligence team
As Trend Micro explains, the release of Vidar 2.0 coincides with the decline of Lumma Stealer. This could suggest a calculated move to capture market share in the cybercrime ecosystem, highlighting the competitive dynamics among malware developers.
The malware’s ability to dynamically adjust thread usage based on system specs reveals a level of resource awareness that is often seen in legitimate software, further blurring the lines between malicious and benign behavior in forensic analysis.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.