Red Asgard’s Contagious Interview follow-up identifies OtterCookie as a second malware family operating alongside BeaverTail/InvisibleFerret in the same campaign infrastructure. The payload from tetrismic.vercel.app used C2 172.86.105.40:5918 and supported endpoints for file exfiltration, screenshots, clipboard and keystroke theft, command polling, and victim registration. OtterCookie is described as more capable than BeaverTail, with system-wide keylogging, multi-monitor screenshot capture every five seconds, registry and scheduled-task persistence, broad VM detection, and targeting of 27 cryptocurrency wallet extensions. The researchers mapped roughly 17-20 servers with a recurring port pattern across hosting providers, including BeaverTail on port 1244 and OtterCookie on port 5918, suggesting standardized deployment. The report also cautions that failed exploitation attempts and other anomalies raise the possibility that the infrastructure could be honeypot or counter-intelligence activity rather than a straightforward live APT platform.