Hunting Lazarus Part VIII: OtterCookie

OtterCookie marks a shift in Lazarus’s developer-targeted operations from one-time data theft to persistent, real-time surveillance, using a live Socket.IO control plane to monitor and broadcast active victims while harvesting keystrokes, clipboard data, screenshots, and secrets—delivered at scale through npm and Vercel supply-chain attacks.