🕵️ InvisibleFerret

The items that name it 10

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas threat actors2026-10-30It is written here as INVISIBLEFERRET (bootstrapper and backdoor; Python 3.12.7 setup, Russia kill switch).

  bootstrapper and backdoor; Python 3.12.7 setup, Russia kill switch

• WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
  writeupas threat actors2026-09-17

  Python second-stage downloader/module associated with BeaverTail/OtterCookie infections; notably absent from WeaselBiscuit.

• The OpenSourceMalware Show #16
  talkas threat actors2026-08-08It is written here as Invisible Ferret.

  Malware referenced as part of the standard DPRK six-stage kill chain alongside NullReceiver and EtherHiding

• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas threat actors2026-07-31It is written here as InvisibleFerret (also tracked as DEV#POPPER RAT).

  Remote-access trojan; a 77KB build landed in the Joyfill compromise for interactive command execution, file upload/download, and clipboard access.

• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  Backdoor malware delivered via git hook-hidden stage-2 loader and via Lazarus Group's Fake Font campaign.

• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeupas threat actors2026-07-15

  Windows artifact family referenced for scanning during remediation, detailed in the reverse-engineering section of the campaign's previous (April) blog post.

• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas threat actors2026-07-08

  Implant also reported as DEV#POPPER RAT and OmniStealer; performs credential theft, browser-data theft, wallet exfiltration, and socket.io-based C2.

• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-12
• Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-08
• VSCode Lifecycle Script Malware
  writeupas threat actors2026-05-16

  Python backdoor deployed by BeaverTail to steal cryptocurrency wallets and browser credentials