Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

BeaverTail has exfiltrated data collected from local systems.

XORIndex Loader has leveraged webservices to identify the public IP of the victim host.

XORIndex Loader has obfuscated strings using ASCII buffers and TextDecoder.

XORIndex Loader has encoded module names and C2 URLs as hexadecimal strings in attempts to evade analysis.

XORIndex Loader has collected the username from the victim host.

XORIndex Loader has leveraged legitimate package names to mimic frequently utilized tools to entice victims to download and execute malicious payloads.

BeaverTail has exfiltrated data collected from victim devices to C2 servers.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

XORIndex Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

XORIndex Loader has executed malicious JavaScript code.

BeaverTail has deleted files from a compromised host after they were exfiltrated.

Contagious Interview has configured malware to remove archives used in collection activities following successful exfiltration.

XORIndex Loader has used HTTPS POST to communicate with C2.

HexEval Loader has used HTTP and HTTPS POST requests to communicate with C2.

BeaverTail has used HTTP GET request to download malicious payloads to include InvisibleFerret and HTTP POST to exfiltrate data to C2 infrastructure.

BeaverTail has staged collected data to the system’s temporary directory.

XORIndex Loader has the ability to collect the hostname, OS Username, Geolocation, and OS version of an infected host.

BeaverTail has searched for .ldb and .log files stored in browser extension directories for collection and exfiltration.

BeaverTail has been used to download a malicious payload to include Python based malware InvisibleFerret.

XORIndex Loader has been used to download a malicious payload to include BeaverTail.

HexEval Loader has been used to download a malicious payload to include BeaverTail.

HexEval Loader has decoded its payload prior to execution.

XORIndex Loader can decode its payload prior to execution.

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

BeaverTail has collected keys associated with macOS within `/Library/Keychains/login.keychain`.

Contagious Interview has leveraged malware variants configured to dump credentials from the macOS keychain.

BeaverTail has stolen passwords saved in web browsers. BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.

BeaverTail has collected and archived sensitive data in a zip file.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.

Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.

Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.

XORIndex Loader can identify the geographical location of a victim host.

Contagious Interview has stolen cryptocurrency wallet credentials and credit card information utilizing BeaverTail and InvisibleFerret malware.