WaterPlum Distributes StoatWaffle Malware in VSCode Supply Chain Attack

Key Takeaways

• North Korea-linked threat actor WaterPlum (Team 8, Moralis, Modilus) is distributing a new modular malware called StoatWaffle.
• The malware infiltrates developer systems via compromised Visual Studio Code (VSCode) repositories, appearing as legitimate blockchain projects.
• StoatWaffle deploys a credential stealer and a remote access trojan (RAT), giving attackers extensive control over infected machines.
• The attack leverages VSCode’s tasks.json and runOn: folderOpen feature, allowing silent execution upon project folder opening.
• Developers are advised to exercise extreme caution with untrusted VSCode projects and review workspace trust settings.

WaterPlum Deploys StoatWaffle via VSCode Supply Chain Attack

A sophisticated new malware, dubbed StoatWaffle, is being deployed by the North Korean state-sponsored threat group WaterPlum. The malware targets developers by infiltrating their machines through malicious Visual Studio Code (VSCode) repositories, which are disguised as authentic blockchain development initiatives.

WaterPlum has a history of conducting campaigns like “Contagious Interview,” designed to lure victims with fake job opportunities and trick them into executing malicious code. This latest operation falls under the purview of Team 8, also identified as Moralis and Modilus, a subgroup of WaterPlum.

Historically, Team 8 relied on the OtterCookie malware family. However, beginning around December 2025, the group transitioned to StoatWaffle, indicating a strategic enhancement of its offensive capabilities and a deliberate shift in its toolkit.

Analysts at NTT Security identified StoatWaffle during their investigation into Team 8’s recent activities. Their report, published on March 17, 2026, highlights StoatWaffle as a significant evolution in WaterPlum’s operational tactics. The malware is described as a fully modular, Node.js-based framework that operates in multiple stages: a loader, a credential-stealing component, and a remote access trojan (RAT). These components work in concert to provide attackers with deep and persistent access to compromised systems.

The Infection Vector: Malicious VSCode Repositories

The attack initiates with a meticulously crafted repository that is shared among developers. Team 8 creates what appears to be a legitimate blockchain project and strategically places it where developers are likely to discover it. Crucially, a hidden .vscode folder within the project contains a tasks.json file configured with a runOn: folderOpen setting. This configuration means that simply opening the project folder in VSCode and granting it trust automatically triggers a pre-defined malicious task, requiring no further interaction from the victim.

This method is particularly insidious because most developers do not anticipate that merely opening a VSCode project folder could silently lead to a full malware infection running in the background, without any manual script execution or explicit prompts.

StoatWaffle’s Multi-Stage Infection Chain

Upon execution, the malicious task contacts a Vercel-hosted web application to download a batch script named vscode-bootstrap.cmd. This script first verifies if Node.js is installed on the system. If absent, it covertly downloads and installs Node.js from the official website, circumventing a potential technical barrier without alerting the user. Subsequently, it fetches a JavaScript file, env.npl, which serves as the initial downloader in StoatWaffle’s infection chain.

The env.npl file establishes a connection to a C2 server at 147[.]124.202.208 on port 3000, polling the /api/errorMessage endpoint every five seconds. When the server responds with an error status, the loader executes the embedded JavaScript code from that response, retrieving the second-stage payload. Approximately five minutes into this polling cycle, the second downloader arrives and begins its own loop against the /api/handleErrors endpoint on the same server, silently spawning hidden child processes to maintain stealth.

Once the second downloader is active, StoatWaffle simultaneously deploys both its Stealer and RAT modules. The Stealer module targets saved browser credentials and cryptocurrency wallet extension data across Chromium-based and Firefox browsers. On macOS, it also extracts the Keychain database. The RAT module awaits commands from the C2 server, enabling capabilities such as listing files, executing shell commands, uploading directories, and searching for files matching specific keywords, thereby granting attackers broad and persistent control over the compromised host.

What You Should Do

• Exercise Caution with Untrusted Projects: Developers should avoid trusting unfamiliar or unverified VSCode repositories, especially those related to blockchain or cryptocurrency projects.
• Review VSCode Workspace Trust Settings: Carefully review and manage VSCode workspace trust settings. Enforce policies that restrict or disable the runOn: folderOpen behavior for untrusted workspaces.
• Block Indicators of Compromise (IoCs): Security teams should block the following IP addresses at the network perimeter: 185[.]163.125.196, 147[.]124.202.208, 163[.]245.194.216, 66[.]235.168.136, and 87[.]236.177.9.
• Monitor for Suspicious Activity: Watch for unexpected Node.js installations or hidden child processes spawned from VSCode, as these can be early indicators of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.