Software · OAK-S30 · malware (Python second-stage backdoor / credential-and-wallet-data infostealer)

OAK-S30 — InvisibleFerret

Type: malware (Python second-stage backdoor / credential-and-wallet-data infostealer)
Aliases: InvisibleFerret (the Palo Alto Unit 42 naming established alongside the BeaverTail naming in the canonical July 2023 publication that first publicly documented both families); industry-side cross-attribution labels include the broader campaign naming "Contagious Interview" (Unit 42 campaign-level naming for the recruiter-pretext intrusion set carrying the BeaverTail → InvisibleFerret payload chain) and "Wagemole" (the adjacent DPRK-IT-worker-fraud campaign sharing operator cohort and tooling); operator-cluster naming overlaps with the broader DPRK Lazarus / TraderTraitor / BlueNoroff intrusion set under CrowdStrike's Famous Chollima naming and Microsoft's Sapphire Sleet / Moonstone Sleet naming.
Active: yes — continuous variants tracked through 2024–2025 with Unit 42, SentinelOne, and Mandiant documenting per-version evolution; the family operates as the persistent-second-stage backdoor in the BeaverTail-led Contagious Interview / Wagemole campaign and is paired with BeaverTail in essentially all observed campaign deployments rather than operating standalone.
First observed: 2023-07 (Palo Alto Unit 42 canonical publication date, paired with the BeaverTail family disclosure in [unit42beavertail2023]; the underlying campaign activity is attributed back at least into early 2023 by retrospective analysis).
Used by Groups: OAK-G01 Lazarus / TraderTraitor cluster and OAK-G08 BlueNoroff / APT38 financial cluster (cross-used across the broader DPRK Lazarus constellation's crypto-industry-targeting surface, with operator-cohort overlap visible in tradecraft-fingerprint, infrastructure-reuse, and wallet-cluster persistence signatures across the OAK-G01 and OAK-G08 attribution surfaces; pairs structurally with OAK-S29 BeaverTail in the canonical two-stage Contagious Interview deployment chain).
Host platforms: cross-platform (Windows, macOS, Linux — the Python implementation runs natively in any Python-3 runtime that the BeaverTail first-stage establishes; cross-platform property mirrors BeaverTail and distinguishes the family from the platform-specific macOS-focused TraderTraitor lineage at OAK-S08).
Observed Techniques: OAK-T11.001 (third-party signing/custody-vendor compromise, downstream from the BeaverTail-established initial-access foothold; InvisibleFerret performs the persistent-access-and-credential-exfiltration phase that enables operator-side movement into vendor signing infrastructure); OAK-T11.002 (wallet-software distribution compromise, where the InvisibleFerret-harvested wallet-extension data and crypto-firm developer credentials feed downstream supply-chain-compromise tradecraft).

Description

InvisibleFerret is the Python-based second-stage backdoor used by the DPRK Lazarus / TraderTraitor / BlueNoroff cluster in the Contagious Interview / Wagemole campaign, paired structurally with the OAK-S29 BeaverTail first-stage loader in the canonical two-stage payload-chain architecture. The canonical reference is the same July 2023 Palo Alto Unit 42 publication that established the BeaverTail naming ([unit42beavertail2023]); the publication documented the BeaverTail-to-InvisibleFerret staging architecture as the campaign's defining tradecraft fingerprint and remains the principal industry reference for the family.

The family's operational role is persistent access plus credential-and-wallet-data exfiltration downstream of BeaverTail's initial reconnaissance-and-credential-theft step. Where BeaverTail performs lightweight first-pass harvesting from browser-stored stores and visible credential files, InvisibleFerret establishes a persistent C2 channel and performs sustained per-host operation: keychain-harvesting (Apple Keychain on macOS, Windows Credential Manager and DPAPI-protected stores on Windows, GNOME Keyring and KDE Wallet on Linux); browser-data exfiltration including saved-passwords, browsing history, autofill data, and cookies-and-session-tokens with particular emphasis on cryptocurrency-exchange-and-wallet-related browser sessions; cryptocurrency-wallet keychain harvesting from MetaMask, Phantom, Solflare, and other browser-extension wallets including encrypted vault material; SSH-key, AWS-credential, GCP-credential, and Kubernetes-config-file harvesting from common project directories; FileGrabber-pattern selective file-exfiltration based on operator-specified extension and content-keyword patterns; and live remote-shell capability for operator-driven hands-on-keyboard activity.

The Python-language implementation choice is operationally significant: Python is widely installed on developer workstations across Windows, macOS, and Linux, which produces a "live-off-the-land" implementation surface where the InvisibleFerret payload can run under a legitimate Python interpreter without requiring binary deployment of language-runtime infrastructure (a structural advantage relative to compiled-language backdoors that require full-binary deployment); Python's standard library and pip-installable third-party libraries provide rich credential-store-access, network-egress, and remote-shell capability without operator-side custom-tooling investment; and the Python codebase is comparatively easy to rotate and refresh as detection-rule pressure increases (operator-side variant rotation observed at faster cadence than for typical compiled-language second-stage backdoors).

The family's role in the OAK-G01 / OAK-G08 monetization chain is the credential-and-wallet-data harvesting node that produces the operator-side intelligence-and-credential-store from which downstream OAK-T10 / T11 extraction Techniques are executed; in some campaign deployments the InvisibleFerret-harvested credentials directly enable operator-side movement into vendor-side signing infrastructure or crypto-firm cloud-credential-protected systems. From a defender perspective the family is the canonical DPRK-cluster persistent-access second-stage paired with a non-direct-download initial-access surface (npm supply chain rather than LinkedIn-and-Telegram lure), structurally parallel to the TraderTraitor → RustBucket / KandyKorn / SwiftLoader / ObjCShellz second-stage progression at OAK-S20 / S21 / S22.

Observed examples

Unit 42 canonical July 2023 publication ([unit42beavertail2023]). Established the InvisibleFerret naming and the BeaverTail-to-InvisibleFerret staging architecture; documented the family's credential-harvesting, wallet-extension-data exfiltration, and persistent-C2 capabilities. Confirmed-grade attribution to DPRK at the cluster level.
Continuous variant evolution (2023–2025). Unit 42, SentinelOne, Mandiant, and CrowdStrike tracked sustained per-version evolution through 2024–2025 with operator-side variant rotation onto modified C2 protocols, refreshed credential-store-target lists, and adjusted persistence-mechanism implementations. Aggregate variant count in the dozens across the campaign window with operator-cohort-attribution to the DPRK Contagious Interview / Wagemole campaign.
macOS-variant evolution and convergence with the broader DPRK macOS lineage. SentinelOne and Jamf Threat Labs documented macOS-specific InvisibleFerret variants whose persistence-mechanism (LaunchAgents plist files written into ~/Library/LaunchAgents/ with non-standard label naming) and child-process invocation patterns (osascript, curl, python3 invocations from base64-encoded staging) converge structurally with the broader DPRK macOS-second-stage lineage at OAK-S20 / S21 / S22. The convergence is operator-cohort-level rather than codebase-level.
Cross-incident credential-and-wallet-data exfiltration (2023–2025). The InvisibleFerret-harvested credential-and-wallet-data has been the documented or strongly-inferred enabling-evidence for multiple per-incident crypto-industry compromises through 2024–2025; per-incident published post-mortems vary in whether they explicitly name InvisibleFerret as the second-stage backdoor, but Mandiant, SentinelOne, and Unit 42 attribute clusters of incidents to the campaign and treat InvisibleFerret-as-second-stage as the dominant 2023–2025 DPRK-against-crypto-developer-workstation pattern. Inferred-strong attribution per industry-forensic source.
OAK on-chain example surface. No OAK examples/ entry exists for InvisibleFerret-binary specifically as of v0.1; the OAK angle is the OAK-G01 / OAK-G08 cluster proceeds laundering tail rather than per-host-deployment incidents.

Detection / attribution signals

Defenders should treat InvisibleFerret-family detection as a host-layer + network-layer joint problem with the BeaverTail-to-InvisibleFerret payload-chain coupling as the most-distinctive cross-stage forensic signature:

Endpoint-side process-tree fingerprints — Python-3 interpreter parent process spawning child processes performing keychain-harvesting, browser-data-exfiltration, and cryptocurrency-wallet-extension-data-exfiltration sequences; persistence on macOS via LaunchAgents plist files written into ~/Library/LaunchAgents/ with non-standard label naming; persistence on Windows via Run-key or Scheduled Task registration under naming that mimics legitimate Python-runtime tooling; persistence on Linux via systemd user-service or cron-job registration. These persistence mechanisms are documented in Unit 42's canonical publication and in continuous SentinelOne / Jamf macOS-side reporting.
Cryptocurrency-wallet-specific process activity — InvisibleFerret variants explicitly enumerate browser-extension installation directories for MetaMask, Phantom, Solflare, and other major cryptocurrency-wallet extensions and exfiltrate their data files; the wallet-extension-directory enumeration pattern is a high-yield host-side detection signature distinguishing InvisibleFerret from generic Python-based credential-stealer families.
Network-layer telemetry — persistent C2 channel egress to operator-controlled infrastructure with periodic heartbeat-and-tasking pattern; FileGrabber-pattern selective file-exfiltration to operator-controlled cloud-storage staging (Mega.io, rclone-to-S3, AnonFiles pre-takedown, and similar). Current C2-domain IOCs published in Unit 42 reporting and continuous CTI-vendor feeds.
Cross-stage payload-chain coupling (the highest-yield campaign-level signature) — detection of either BeaverTail or InvisibleFerret on a host raises the prior on the other family's presence to near-certainty given the campaign's structural pairing of the two; the BeaverTail-to-InvisibleFerret staging coupling is the most-distinctive Contagious Interview campaign-level forensic signature.
CTI vendor coverage — Palo Alto Unit 42 (canonical July 2023 publication and continuous tracking; [unit42beavertail2023], [unit42invisibleferret2024]), SentinelOne (sustained tracking and macOS-variant analysis), Jamf Threat Labs (macOS-specific InvisibleFerret detection), Mandiant (Wagemole-and-Contagious-Interview campaign reporting), CrowdStrike (Famous Chollima cluster naming and continuous tracking), Microsoft Threat Intelligence (Sapphire Sleet / Moonstone Sleet related-cluster naming).
Cross-correlation with on-chain cluster watchlists — a workstation compromise consistent with InvisibleFerret on a vendor whose downstream signing key reaches into a crypto-firm cold-wallet path raises the prior on a subsequent OAK-T11.001 / T11.003 extraction event; integrating endpoint-detection telemetry with on-chain G01 / G08 cluster watchlists is a defender-grade compounding control.

Note: omit specific file hashes from this entry. Defenders should consume current IOCs from Unit 42's published indicator list and from the live CTI-vendor feeds named above.

Citations

[unit42beavertail2023] — Palo Alto Unit 42, "Hacking Employers and Seeking Employment: DPRK Threat Actors Use Contagious Interview Campaign," July 2023; canonical publication establishing both the BeaverTail and InvisibleFerret naming and the staging architecture. (NEW citation — see summary.)
[unit42invisibleferret2024] — Palo Alto Unit 42 follow-up reporting on InvisibleFerret variant evolution through 2024. (NEW citation — see summary.)
[mandiantwagemole2024] — Mandiant Wagemole-and-Contagious-Interview campaign convergence reporting. (NEW citation — see summary.)
[crowdstrikefamouschollima2024] — CrowdStrike Famous Chollima cluster naming and operator-cohort-tracking documentation. (NEW citation — see summary.)
[sentineloneinvisibleferret2024] — SentinelOne InvisibleFerret continuous tracking and macOS-variant analysis. (NEW citation — see summary.)
[jamfinvisibleferret2024] — Jamf Threat Labs macOS-specific InvisibleFerret detection-and-tracking work. (NEW citation — see summary.)
[chainalysis2024dprk] — DPRK-attributed cryptocurrency-theft and ransom-proceeds aggregate context (also cited in OAK-G01, OAK-S08, OAK-S25, OAK-S29).

Discussion

On lineage. InvisibleFerret sits within the broader DPRK Lazarus / TraderTraitor / BlueNoroff cluster's second-stage backdoor lineage, pairing structurally with the OAK-S29 BeaverTail first-stage loader in the canonical Contagious Interview campaign chain. The family is operationally parallel to but architecturally distinct from the macOS-second-stage lineage at OAK-S20 RustBucket, OAK-S21 SwiftLoader, and OAK-S22 ObjCShellz — those families are platform-specific compiled-language implementations, while InvisibleFerret is a cross-platform Python implementation. The lineage convergence is at the operator-cohort level (same DPRK cluster) and at the operational-role level (second-stage-backdoor-after-initial-access-payload) rather than the codebase or platform level.

On the BeaverTail / InvisibleFerret two-stage architecture. See OAK-S29 Discussion for the broader two-stage architectural framing. From the second-stage side specifically, the architectural advantage is operator-side capability concentration in the second stage — InvisibleFerret carries the bulk of the campaign's credential-harvesting and wallet-data-exfiltration capability, while BeaverTail is comparatively lightweight. This concentration produces several operational benefits: variant rotation pressure concentrates on the second stage (where capability matters most) rather than dispersing across both stages; first-stage-detection by registry-side malicious-package scanning does not necessarily compromise second-stage capability if the operator can re-establish first-stage delivery via a refreshed package surface; second-stage-detection on a host indicates both that BeaverTail successfully delivered and that the host is on the operator's active-target list.

On the Python-language design choice and live-off-the-land properties. Python's ubiquity on developer workstations produces a structural detection-evasion advantage relative to compiled-language second-stage backdoors: the Python interpreter itself is a legitimate-software baseline; the operator-supplied Python script can be obfuscated via standard Python obfuscation techniques (base64-encoded payloads, dynamic-import-based code-loading, AST-level obfuscation); Python's subprocess and os modules provide rich shell-command-execution capability without requiring operator-side custom-tooling investment. The structural property that the language runtime is the legitimate-software baseline is the principal architectural advantage of the InvisibleFerret design choice and is a non-trivial reason why Python-based second-stage backdoors are increasingly common in modern intrusion-set tradecraft.

On ecosystem position. InvisibleFerret is the persistent-access-and-credential-exfiltration node downstream of the BeaverTail initial-access node in the DPRK Contagious Interview campaign's payload-chain architecture. Downstream of InvisibleFerret, the chain runs through OAK-G01 / OAK-G08-attributed extraction Techniques (T10.001, T11.001, T11.002, T11.003) and OAK-T7-Tactic laundering. A defender control program targeting InvisibleFerret at the host-and-network-detection layer compounds with on-chain G01 / G08 cluster watchlists at the off-ramp layer; either alone is partial coverage.