New WeaselBiscuit Stealer Targets Chrome Extensions via Npm

Cybersecurity researchers have uncovered a previously undocumented JavaScript stealer named WeaselBiscuit, which spreads through 13 malicious npm packages. The malware is designed to harvest sensitive data stored in Chrome extensions, posing a direct risk to developers and users who rely on browser tools for financial or identity management.

According to OpenSourceMalware, the tool is a stripped-down version of larger malware families associated with North Korean threat actors. While it lacks some advanced capabilities like remote access or cryptocurrency wallet draining, its focus on extracting extension data makes it financially significant for victims.

Simplified Malware Design Reduces Detection

WeaselBiscuit is notably smaller and lighter than its predecessors, BeaverTail and OtterCookie. Security expert Paul McCarty noted that many heavier functions were removed entirely, resulting in a self-contained stealer. This simplicity likely helps it evade detection systems that are tuned to catch more complex, multi-stage attacks.

The malware is triggered when a developer imports one of the affected npm packages. A loader script then pulls the main payload from an online storage service and executes it directly in memory. This in-memory execution avoids leaving traditional files on the disk, making forensic analysis more difficult for defenders.

Targeting Browser Extension Data

Once active, the stealer profiles the compromised host and connects to a command-and-control server. It specifically targets the local storage directories of Chrome extensions across Windows, macOS, and Linux. It uploads every readable file in these directories, which often contain session tokens, API keys, and user preferences.

On Windows systems, the malware can also log keystrokes and clipboard contents if directed by the operators. The primary financial motivation lies in the extension data, which can expose the state of wallet extensions or other sensitive application data. This allows attackers to potentially hijack accounts or access funds without needing to drain crypto wallets directly.

Attribution Remains Uncertain Despite Links

While the malware shares functional overlaps with tools used by North Korean actors, definitive attribution is lacking. OpenSourceMalware emphasized that there is no conclusive evidence from infrastructure or campaign metadata to link it directly to the DPRK. However, tradecraft signals, such as the use of specific online JSON services and IP lookup methods, mirror those seen in previous North Korean campaigns.

The Hacker News reported that these similarities, including the use of numerical campaign IDs to track infections, suggest a potential connection. If confirmed, this would represent a new evolution in how state-sponsored actors merge features from different malware families to target software developers and IT professionals.