Wazuh describes InvisibleFerret as a Python-based backdoor used in North Korea-linked campaigns, especially Lazarus recruitment-themed operations against technology, finance, and cryptocurrency professionals. The malware is delivered as a second-stage payload by the BeaverTail JavaScript loader and stealer, then collects host identity, geolocation, network, file, keylogging, and clipboard data from Windows or Linux endpoints. The Linux-focused detection guide notes temporary obfuscated files, prioritized file and directory lists for theft, FTP and Telegram Bot exfiltration, and AnyDesk download for remote access. It provides Wazuh and SysmonForLinux rules for detecting those behaviors and active-response steps to remove the malware.