InvisibleFerret malware now uses .pyd and .so files to evade script-based detection

North Korea-linked hackers have updated InvisibleFerret, a malware family used to steal credentials, cryptocurrency wallet data, and developer secrets. The newest version no longer arrives mainly as readable Python scripts. It now ships as Cython-compiled .pyd files on Windows and .so files on macOS.

The change makes the malware harder to catch with older detection rules that look for suspicious Python script patterns. A Trend Micro analysis says Void Dokkaebi, also tracked as Famous Chollima, made the shift while keeping InvisibleFerret’s core stealing and backdoor functions.

The campaign matters most to software developers, cryptocurrency users, and companies whose employees have access to source code, signing keys, production systems, or CI/CD pipelines. The attackers continue to rely on fake job interviews and malicious repositories to push victims into running infected code.

What changed in the latest InvisibleFerret malware

InvisibleFerret has long been known as a Python-based threat. The new version hides that Python logic inside compiled extension modules, which makes the malware less readable during static analysis.

Cython converts Python code into C or C++ code, then compiles it into native binary modules. On Windows, the attackers use .pyd files. On macOS, they use .so files.

Those files do not run by themselves like normal apps. The infection chain writes a helper Python script, such as .mod, to load the compiled module and pass runtime arguments, including command-and-control details.

Key details at a glance

Item	Details
Malware family	InvisibleFerret
Threat actor	Void Dokkaebi, also tracked as Famous Chollima
Reported alignment	North Korea-aligned activity
New packaging	Cython-compiled .pyd files on Windows and .so files on macOS
Loader	BeaverTail
Main targets	Developers, cryptocurrency users, and organizations with sensitive engineering access
Main risk	Credential theft, wallet theft, keylogging, clipboard monitoring, and backdoor access

Why .pyd and .so files make detection harder

Security tools often scan scripts for suspicious imports, encoded strings, command execution, and known malware patterns. That approach becomes weaker when the original Python code has been converted into binary extension modules.

The compiled files still contain artifacts that analysts can recover, including module names, build paths, compressed strings, and encoded command-and-control values. However, defenders must inspect binaries and related execution scripts together to understand the full infection chain.

The Trend Micro report also warns that runtime scripts can override command-and-control details that appear inside the binary. That means analysts may miss the real destination if they inspect only the .pyd or .so file.

InvisibleFerret remains a modular theft tool

InvisibleFerret has a longer history as a modular Python malware family used for remote access and data theft. MITRE ATT&CK lists InvisibleFerret as malware used for data exfiltration and remote access across Linux, macOS, and Windows.

The current Cython-wrapped version keeps that broader role. Its modules can collect system information, steal browser authentication data, monitor the clipboard, log keystrokes on Windows, and target cryptocurrency wallet data.

Trend Micro identified several module names that defenders should recognize. mod.pyd or mod.so starts the InvisibleFerret chain, pad.pyd or pad.so handles backdoor-style functions, brw.pyd or brw.so targets browser data, and mc.so focuses on wallet extension tampering on macOS.

BeaverTail now does more than download payloads

BeaverTail remains a key part of the attack chain, but its role has expanded. It can still deliver InvisibleFerret, yet newer variants also perform credential theft, wallet theft, backdoor activity, and browser extension tampering.

The latest reporting describes four BeaverTail variants. The gjs component steals data and downloads more payloads. The njs component provides backdoor functions. The zjs component targets wallet seed phrases and private keys. The cjs component installs trojanized extensions in Chrome and Brave Browser.

This overlap makes the campaign more flexible. Even if one stage fails, another component may still steal valuable information or establish control over the machine.

Fake recruiters remain central to the operation

The attackers continue to rely on social engineering. They pose as recruiters from cryptocurrency, AI, or technology companies, then ask developers to clone repositories, run code, or complete technical tasks as part of a fake interview.

Palo Alto Networks Unit 42 previously tracked similar DPRK activity under the Contagious Interview campaign. Its research described fake recruiter lures that pushed tech job seekers into installing BeaverTail and InvisibleFerret variants.

The tactic works because developers often expect to download code during interviews. That creates a dangerous trust gap, especially when attackers disguise the task as a normal coding test.

The target pool is expanding

Software developers remain a core target, but North Korean malware operators have also tested ways to reach non-developer roles. That matters because compiled malware can run on systems where users may not already have developer tools installed.

GitLab threat intelligence identified infrastructure used to distribute BeaverTail and InvisibleFerret variants since at least May 2025. GitLab also reported ClickFix-style lures targeting marketing and trader roles in cryptocurrency and retail organizations.

ClickFix attacks try to make victims run commands by showing fake technical errors, fake CAPTCHA prompts, or troubleshooting instructions. This gives attackers a way to move beyond traditional fake coding tests.

Wallet theft remains a major goal

InvisibleFerret and BeaverTail both show strong interest in cryptocurrency wallets. The malware can target browser credentials, wallet data, seed phrases, private keys, and wallet extensions.

The macOS mc.so module is especially concerning because it can install trojanized wallet extensions in Chrome and Brave Browser. It can also downgrade Chrome on macOS to work around newer extension security restrictions.

Trend Micro said the current mc.so targets MetaMask, Coinbase Wallet, and Phantom. The researchers expect the number of targeted wallet extensions to grow.

Indicators defenders should monitor

Indicator type	Indicator
Windows module	mod.pyd, pad.pyd, brw.pyd
macOS module	mod.so, pad.so, brw.so, mc.so
Execution script	.mod, pad0, brw0, mc0
Known drop path	.vscode/mod.pyd, .vscode/mod.so, .vscode/pad.pyd, .vscode/pad.so
C2 indicator	45[.]59[.]160[.]199
Abused lookup URL	hxxp://ip-api[.]com/json
Suspicious behavior	Unexpected Python loading compiled modules from project folders

How defenders should adjust detection

Teams should stop treating InvisibleFerret as only a script-based threat. The latest activity requires binary-aware detection, monitoring for Python extension modules, and correlation between .pyd or .so files and helper scripts.

Security teams should watch for compiled modules inside .vscode directories, unexpected Python interpreter launches, and project folders that contain both source files and hidden malware components.

Developers should also treat interview repositories with caution. A code test from an unknown recruiter should never run on a primary workstation, especially one with wallet data, SSH keys, cloud credentials, or production access.

Recommended steps for organizations

• Block or alert on unexpected .pyd and .so files in developer project folders.
• Monitor .vscode directories for hidden loaders, compiled modules, and unusual scripts.
• Review Python processes that import compiled modules from newly cloned repositories.
• Use isolated virtual machines for coding tests from unknown recruiters.
• Keep cryptocurrency wallets off development systems where possible.
• Rotate credentials if a developer ran suspicious interview code.
• Hunt for Chrome downgrades on macOS and unexpected wallet extension changes.
• Review CI/CD access from workstations used during external interviews.

Why this matters for software supply chains

A compromised developer workstation can affect more than one person. If attackers steal signing keys, cloud tokens, Git credentials, or CI/CD secrets, they may pivot into company infrastructure.

MITRE notes that InvisibleFerret has historically been introduced through BeaverTail and used by North Korea-affiliated threat actors tied to DeceptiveDevelopment or Contagious Interview activity since 2023.

That history makes the newest Cython shift more than a packaging update. It shows the operators are adapting to defender awareness and trying to keep a proven developer-targeting playbook effective.

Compiled malware is part of a wider trend

North Korean operators have repeatedly changed formats, lures, and delivery chains to reduce detection. GitLab’s research also observed compiled malware variants and low static detection rates in related activity.

Unit 42 previously documented continuous updates to BeaverTail and InvisibleFerret, including cross-platform malware behavior for Windows and macOS.

The latest InvisibleFerret update follows the same pattern. The malware still depends on social engineering, but its technical packaging now makes script-only security controls less reliable.

The bigger picture

InvisibleFerret’s move to .pyd and .so files shows how quickly malware operators adapt once defenders recognize older scripts. The underlying goals remain the same: steal credentials, take wallet data, monitor users, and maintain access.

For organizations, the priority should be clear. Treat fake recruiter activity as a security risk, isolate untrusted code tests, and expand detection beyond readable scripts.

For developers, the safest approach is simple. Do not run unknown interview repositories on a real work machine. Use disposable environments, avoid storing wallet data on development systems, and report suspicious recruiter workflows early.

FAQ