Cisco Talos linked a new intrusion to Famous Chollima, a DPRK-aligned subgroup of Lazarus that uses fake hiring activity to compromise job seekers and steal credentials and cryptocurrency. A system in a Sri Lanka-headquartered organization was likely infected after a user installed a trojanized Node.js application called Chessfi, distributed through the npm package node-nvm-ssh. Talos found BeaverTail and OtterCookie functionality merging in recent tooling, including a previously undocumented OtterCookie module for keylogging, desktop screenshots, and in one sample clipboard theft. The malware used socket.io-based C2, remote shell capability, file upload modules, cryptocurrency wallet and browser-extension theft, and observed infrastructure including 172.86.88.188 and 138.201.50.5. Talos also found a malicious VS Code extension containing BeaverTail and OtterCookie code, though it did not attribute that extension to Famous Chollima with high confidence.