
Mapping Ottercookie Infrastructure
By: Jason Reaves
Medium"Blurred Lines of Cyber Threat Attribution: The Evolving Tactics of North Korean Cyber Threat Actors" published by Zscaler.
#Kimsuky,
#Lazarus,
#Slides,
#DPRK,
#CTI https://www.dailysecu.com/form/html/k-cti/pdf/2026/down-B-1.pdf
Resecurity | Supply Chain Malware Alert: plain-crypto-js Compromises Axios Packages

OtterCookie Expands Targeting to AI Coding Tools
Malicious npm packages spoofing Gemini and popular JavaScript libraries deliver OtterCookie, targeting software developers
Cyber and Ramen
From Axios NPM Supply Chain Attack to Tracking DPRK’s BlueNoroff
Key Facts
Medium
Axois NPM Supply Chain Incident
Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure.
Cisco Talos Blog
Technical Advisory: Axios npm Supply Chain Attack - Cross-Platform RAT Deployed via Compromised Maintainer Account
[CRITICAL] | Active RAT | Malicious npm versions removed | Assess all systems that ran npm install during exposure window
.
Bitdefender Blog"Code Names, Fake Personas, and Iranian Recruits: New Details from Inside the NKITW Operation" published by Flare.
#ITWorker,
#DPRK,
#CTI https://flare.io/learn/resources/blog/iranian-recruits-inside-the-nkitw-operation
New Details of Iranian Recruits from Inside the NKITW Operation - Flare
The North Korean regime is likely hiring, with intention, individuals from Syria, Saudi Arabia, and Iran as part of its IT worker infiltration program.
Flare | Threat Exposure Management | Unmatched Visibility into Cybercrime