InvisibleFerret

InvisibleFerret is a modular, cross‑platform malware written in Python that provides both data exfiltration and remote access capabilities to its operators. The code base is split into four distinct modules: the main controller, an optional payload injector, a browser manipulation component, and an AnyDesk wrapper used for establishing legitimate remote desktop sessions on compromised machines. This modular structure allows attackers to tailor each engagement by disabling unused features, thereby reducing their attack surface and footprint. The malware first enters target environments through the BeaverTail delivery system—a separate threat group’s spear‑phishing tool that drops or self‑executes InvisibleFerret onto victims’ systems. After initial execution the main module downloads additional code segments from command and control (C2) servers, then optionally activates the AnyDesk interface to allow operators to manipulate the victim’s desktop or to use AnyDesk as a persistence channel. The browser hook can harvest credentials, inject malicious payloads into user sessions, or exfiltrate sensitive data through HTTP/HTTPS channels controlled by the malware. Since 2023 it has been linked to North Korean actors known as DeceptiveDevelopment or Contagious Interview. These groups typically employ InvisibleFerret in supply‑chain attacks and targeted intrusion campaigns where stealth and cross‑platform reach are essential. In addition to exfiltration, the suite can collect system information, log keystrokes, or maintain persistence through scheduled tasks or launch agents on macOS. Operators have leveraged legitimate software (AnyDesk) within the malware’s own code path to bypass traditional RDP‑related detection controls. Defenders should treat InvisibleFerret as a highly adaptable threat that blends legitimate tools with malicious intent. Awareness of its modular nature and potential use of AnyDesk for persistence or lateral movement is critical in crafting effective detection rules.",