Malware
InvisibleFerret
- First Reported
- Oct 16, 2025
- Latest Reported
- May 22, 2026
Reported Context (3)
- Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware Void Dokkaebi Uses Cython-Compiled InvisibleFerret to Evade Script-Based Detection
- the blockchain reference, including other malware that have been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in Void Void Dokkaebi Uses Fake Job Interviews to Spread Malware Through Developer Repositories
- uses BeaverTail and OtterCookie, with many individual sub-clusters of activities installing InvisibleFerret, a Python based modular payload. Although BeaverTail and OtterCookie originated as BeaverTail and OtterCookie Add Keylogging and Screenshot Capabilities
Malware (6)
People (4)
Threat Actors (3)
MITRE ATT&CK (18)
Vendors (1)
Products (32)
Tools (3)
Industries (3)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.