S1246: BeaverTail
BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview. BeaverTail has been delivered to victims through code repository sites and has been embedded within malicious attachments.[1][2][3][4]
Security context for executives and security teams
S1246: BeaverTail describes [BeaverTail](https://attack.mitre.org/software/S1246) is a malware that has both a JavaScript and C++ variant. Active since 2022, [BeaverTail](https://attack.mitre.org/software/S1246) is capable of stealing logins from browsers and serves as a downloader for second stage payloads. [BeaverTail](https://attack.mitre.org/software/S1246) has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or [Contagious Interview](https://attack.mitre.org/groups/G1052). [BeaverTail](https:/...
Executive priority
S1246: BeaverTail is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1246: BeaverTail by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, macOS, Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1246: BeaverTail appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
BeaverTail
BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview. BeaverTail has been delivered to victims through code repository sites and has been embedded within malicious attachments.[1][2][3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1071.001 | Web ProtocolsSub-technique | BeaverTail has used HTTP GET request to download malicious payloads to include InvisibleFerret and HTTP POST to exfiltrate data to C2 infrastructure.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025[1] |
| Enterprise | T1059.007 | JavaScriptSub-technique | BeaverTail has executed malicious JavaScript code.[2]CitationRecorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025[3][4][1] BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS.CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1555.003 | Credentials from Web BrowsersSub-technique | BeaverTail has stolen passwords saved in web browsers.[2]CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025CitationSocket HexEval BeaverTail Contagious Interview June 2025CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.[3] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | BeaverTail has exfiltrated data collected from victim devices to C2 servers.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025[1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1654 | Log Enumeration | BeaverTail has identified .ldb and .log files stored in browser extension directories for collection and exfiltration.[3] |
| Enterprise | T1195.001 | Compromise Software Dependencies and Development ToolsSub-technique | BeaverTail has been hosted on code repositories and disseminated to victims through NPM packages.[2]CitationRecorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025[4][1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1217 | Browser Information Discovery | BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.[2]CitationRecorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025CitationSocket HexEval BeaverTail Contagious Interview June 2025[3][1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1082 | System Information Discovery | BeaverTail has been known to collect basic system information.[2][1] BeaverTail has also collected data to include hostname and current timestamp prior to uploading data to the API endpoint `/uploads` on the C2 server.[3] |
| Enterprise | T1074.001 | Local Data StagingSub-technique | BeaverTail has staged collected data to the system’s temporary directory.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025 |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | BeaverTail has collected and archived sensitive data in a zip file.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025 |
| Enterprise | T1005 | Data from Local System | BeaverTail has exfiltrated data collected from local systems.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025[3][1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | BeaverTail has obfuscated strings of code with Base64 encoding within the JavaScript version of the malware.[3][1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 BeaverTail has also utilized the open-source tool JavaScript-Obfuscator to obfuscate strings and functions.[2][4] |
| Enterprise | T1124 | System Time Discovery | BeaverTail has obtained and sent the current timestamp associated with the victim device to C2.[3] |
| Enterprise | T1571 | Non-Standard Port | BeaverTail has communicated with C2 IP addresses over ports 1224 or 1244.[3][1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1555 | Credentials from Password Stores | BeaverTail has collected keys stored for Solana stored in `.config/solana/id.json` and other login details associated with macOS within `/Library/Keychains/login.keychain` or for Linux within `/.local/share/keyrings`.[3] |
| Enterprise | T1204.002 | Malicious FileSub-technique | BeaverTail has been executed through lures involving malicious JavaScript projects or trojanized remote conferencing software such as MicroTalk or FreeConference.[3]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 BeaverTail has also been executed through macOS and Windows installers disguised as chat applications.[2][4] |
| Enterprise | T1001.001 | Junk DataSub-technique | BeaverTail has added junk data or a dummy character prepended to a string to hamper decoding attempts.[3] |
| Enterprise | T1105 | Ingress Tool Transfer | BeaverTail has been used to download a malicious payload to include Python based malware InvisibleFerret.[2]CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025CitationSocket HexEval BeaverTail Contagious Interview June 2025[3][1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1083 | File and Directory Discovery | BeaverTail has searched for .ldb and .log files stored in browser extension directories for collection and exfiltration.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025CitationSocket HexEval BeaverTail Contagious Interview June 2025[3] |
| Enterprise | T1036 | Masquerading | BeaverTail has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1070.004 | File DeletionSub-technique | BeaverTail has deleted files from a compromised host after they were exfiltrated.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025 |
| Enterprise | T1657 | Financial Theft | BeaverTail has searched the victim device for browser extensions commonly associated with cryptocurrency wallets.[2]CitationRecorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025[3][1]CitationPaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 |
| Enterprise | T1555.001 | KeychainSub-technique | BeaverTail has collected keys associated with macOS within `/Library/Keychains/login.keychain`.CitationSocket BeaverTail XORIndex HexEval Contagious Interview July 2025CitationSocket HexEval BeaverTail Contagious Interview June 2025[3] |
Groups, software, and campaigns
G1052: Contagious Interview
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. [1][2][3][4][5][6][7][8]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | dc859a8627ca… | ||
| 19.1 | 1.0 | Older bundle | dc859a8627ca… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.
Open source URL - [2]Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024
eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.
Open source URL - [3]ESET Contagious Interview BeaverTail InvisibleFerret February 2025
Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.
Open source URL - [4]Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.
Open source URL - [5]mitre-attackS1246Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.