InvisibleFerret Malware Evades Detection with New .pyd and .so File Types

Key Takeaways

• A North Korea-backed threat group, Void Dokkaebi (also known as Famous Chollima), has significantly updated its InvisibleFerret malware.
• The malware now employs Python extension modules (.pyd for Windows, .so for macOS) compiled with Cython, enabling it to bypass traditional script-based detection mechanisms.
• This evolution makes InvisibleFerret a more stealthy and potent information stealer, targeting software developers and cryptocurrency users for credentials, signing keys, and access to critical systems.
• The accompanying BeaverTail loader has also expanded its capabilities and employs enhanced obfuscation techniques.

InvisibleFerret Malware Evolves for Enhanced Evasion

A sophisticated information-stealing malware, InvisibleFerret, linked to the North Korean threat actor Void Dokkaebi (also tracked as Famous Chollima), has undergone a significant upgrade, adopting new file types to circumvent established cybersecurity defenses. The updated malware now deploys as compiled Python extension modules (.pyd for Windows and .so for macOS) rather than easily detectable Python scripts.

This strategic shift, detailed in a recent report by Trend Micro, allows InvisibleFerret to evade many traditional detection methods that rely on identifying patterns in plain Python code. The threat group, known for its focus on software developers holding valuable assets like cryptocurrency wallet credentials, signing keys, and access to build pipelines, continues to leverage social engineering tactics. They frequently impersonate recruiters from cryptocurrency or AI firms, luring developers into executing malicious code disguised as part of fake job interviews.

Technical Details of the Malware’s Evolution

The core innovation in this InvisibleFerret variant is its transformation from raw Python scripts into Cython-compiled binaries. On Windows systems, the malware manifests as .pyd files, which are Python extension modules in a Dynamic Link Library (DLL) format. For macOS environments, it appears as .so files, representing shared libraries. Crucially, neither of these compiled formats can execute independently without a Python interpreter present on the target system. This compilation process renders the malicious code opaque to security tools designed to scan for typical Python script signatures.

To facilitate execution, the infection chain writes a small companion .mod script to disk. This script is then responsible for launching the compiled binary. While static analysis of these binaries can still reveal embedded IP addresses and port numbers, the runtime execution scripts possess the capability to override these values, directing the malware to alternative command-and-control (C2) destinations via arguments passed during execution.

InvisibleFerret maintains its comprehensive set of malicious functionalities. These include establishing backdoor access, exfiltrating browser credentials, monitoring clipboard data, logging keystrokes, and targeting cryptocurrency wallets for illicit gains. The malware operates through four distinct modules:

• mod: Manages the initial connection and downloads subsequent payloads.
• pad: Provides backdoor capabilities and collects system information.
• brw: Specifically designed to steal authentication data and credit card details from web browsers.
• mc (macOS only): Installs trojanized wallet extensions and downgrades Google Chrome to bypass newer extension security frameworks, facilitating the theft of cryptocurrency.

BeaverTail Expands Its Role in the Infection Chain

In parallel with InvisibleFerret’s repackaging, the accompanying loader, BeaverTail, has also evolved into a more sophisticated component of the attack chain. BeaverTail now features four distinct variants, each with specialized functions:

• gjs: Handles data exfiltration and downloads additional malicious components.
• njs: Provides backdoor functionalities for persistent access.
• zjs: Focuses on stealing cryptocurrency wallet seed phrases and private keys.
• cjs: Installs trojanized extensions in popular browsers like Chrome and Brave, specifically targeting cryptocurrency wallets such as MetaMask, Coinbase Wallet, and Phantom.

BeaverTail’s obfuscation techniques have also seen significant enhancements. The updated code dynamically shuffles a large array of Base64 fragments at startup, effectively defeating simple signature-based detections. It also employs XOR encryption with a 4-byte key for sensitive strings, such as file paths, further complicating analysis. To obscure its C2 infrastructure, command-and-control IP addresses are split into halves, swapped, and then Base64 encoded, making direct extraction more challenging for security researchers.

This ongoing campaign poses a significant threat to software developers, cryptocurrency users, and organizations whose personnel have access to sensitive assets like signing keys or CI/CD pipelines. Security teams relying solely on script-based detection methods will find a critical gap in their defenses against this updated threat.

What You Should Do

• Update Detection Strategies: Shift from script-only detection to binary-aware approaches. Implement security solutions capable of analyzing Python extension modules (.pyd, .so), embedded artifacts, and runtime execution scripts.
• Monitor for Anomalous Activity: Watch for unusual Python process activity, particularly in non-standard directories like .vscode. Be vigilant for Chrome version downgrades on macOS and the installation of unauthorized or trojanized browser extensions, especially those related to cryptocurrency wallets.
• Enhance Developer Security: Educate developers about social engineering tactics, particularly those involving fake job offers from cryptocurrency or AI firms. Implement strict code review processes and ensure that all code repositories are thoroughly vetted before execution.
• Strengthen Endpoint Security: Deploy advanced endpoint detection and response (EDR) solutions that can identify and block malicious activity at the execution stage, regardless of the initial file type.
• Apply Deobfuscation Methods: Security analysts familiar with previous InvisibleFerret versions can apply similar deobfuscation techniques, as the core logic within the compiled binaries remains largely consistent.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.