Analysis Traces Contagious Interview Campaign Through OtterCookie and InvisibleFerret Payloads

Jan 20, 2026 · Original article ↗

Summary

Static analysis traces a fake-recruiter campaign from a malicious npm package to OtterCookie and a PyInstaller-compiled InvisibleFerret payload, documenting credential theft, cloud-data collection, remote access and persistence.

Key points

The campaign reportedly lures developers with fake job interviews and coding challenges, including a malicious npm package named tailwindcss-forms-kit.
The package retrieves obfuscated JavaScript that targets browser credentials, cryptocurrency wallets, cloud credentials and sensitive files, and supports remote commands and persistence.
The first-stage malware downloads an OS-specific second-stage payload; the analysis links it to OtterCookie based on shared wallet targets, tooling and behavior.
The third-stage Windows and Linux samples were identified as PyInstaller-compiled Python 3.10 binaries. Embedded libraries and comparison with published research support the author’s identification of InvisibleFerret; the samples were not executed.
The article documents C2 and upload behavior, file hashes, persistence locations and other indicators, and recommends verifying recruiters and isolating or reviewing interview code before execution.

Article Details

Attack Vectors: Fake recruiters approach software developers on LinkedIn and other job platforms, then ask them to run a coding challenge or install software during the interview process.
A malicious npm package, tailwindcss-forms-kit, delivers obfuscated JavaScript when imported.
The first-stage malware downloads and executes platform-specific later-stage payloads from its C2 infrastructure.
Defensive Notes: Independently verify recruiter identities and job postings through company websites or switchboards.
Review third-party npm packages before installation and run interview coding challenges in isolated containers or virtual machines.
Do not run untrusted code with elevated privileges or disable security tools during interviews.
Use hardware security keys and MFA, protect SSH keys with passphrases, and rotate API keys and tokens regularly.
Separate development workstations from production access and restrict execution of unsigned executables, especially from temporary and download directories.

Indicators of compromise

Type	Indicator	Context
IPV4	`95[.]164[.]17[.]24`	Listed as documented InvisibleFerret C2 infrastructure.
IPV4	`95[.]216[.]37[.]186`	Primary C2 host; the article also describes file-upload and content-upload services on this host.
MD5	`153e2f27e035252d5f7ace69948e80b2`	MD5 hash of the analyzed Windows third-stage payload.
MD5	`5a2c042b086a475dca4c7dcec62693c1`	MD5 hash of the analyzed Linux third-stage payload.
SHA256	`1c8c1a693209c310e9089eb2d5713dc00e8d19f335bde34c68f6e30bccfbe781`	SHA-256 hash of the analyzed Windows third-stage payload.
SHA256	`699cd6c292b8a5933dabee63c74a9a3069ed6432c3433ab945ab46fe816d9e2c`	SHA-256 hash of the analyzed Linux third-stage payload.
SHA256	`eba9fdb2f077f9a3e14cf428162b967b5e6c189db19c33c5b11601efcd02b3d3`	SHA-256 hash cited for a previously documented PyInstaller-compiled InvisibleFerret variant.
URL	`hxxp[:]//95[.]216[.]37[.]186:3000`	Publicly accessible web console for the reported C2 infrastructure.
URL	`hxxp[:]//95[.]216[.]37[.]186:3011/file-upload`	Secondary exfiltration endpoint used for file uploads.
URL	`hxxp[:]//95[.]216[.]37[.]186:5000/content-upload`	C2 endpoint used to exfiltrate text-file contents.
URL	`hxxp[:]//95[.]216[.]37[.]186:5000/download-app`	C2 endpoint used to download the next-stage payload.
URL	`hxxp[:]//95[.]216[.]37[.]186:5000/file-upload`	C2 file-upload endpoint used to exfiltrate files.
URL	`hxxps[:]//api[.]npoint[.]io/9d94ec6053e75dbd933e`	Specific resource from which the malicious package retrieves an obfuscated JavaScript payload.