Pulse Detail — Threat Intelligence

PULSE NAME

Triple Fork: OtterCookie Variant Delivered via Bitbucket Developer Lure | ThreatProphet

WHITE Lazarus ThreatProphet 2026-04-01 Modified: 2026-05-01

IOCs

MEDIUM VOLUME

An OtterCookie-family three-child loader was deployed in a Contagious Interview campaign that targeted developers, cryptocurrency wallets, and 2FA seeds, according to an analysis by security researchers.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1027 T1036 T1041 T1057 T1059 T1071 T1083 T1105 T1115 T1140 T1555 T1566 T1074 T1106 T1134 T1486 T1547 T1176

MALWARE FAMILIES

Contagious Interview OtterCookie

Indicators of Compromise (19)

All FileHash-SHA256 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	17fc8a5acc76fcbf9f2dbc0f68d2e80cd1b5187f8ccab3d2a014898dadc44fc8	—	2026-04-01
FileHash-SHA256	790277d4067c6fd0a36f450ae8c83bd2e4e5f812eb3a86f83c9b9a1c67f9a63e	—	2026-04-01
FileHash-SHA256	8c1d99ea78e07c8ec88671a56729d19fcff0def699c3b8dc3b42861112497293	—	2026-04-01
FileHash-SHA256	df8768c18dce2140b5a1df78dcb821f103409b6c5bbf86f09bf1ceefb6e75c43	—	2026-04-01
URL	http://144.172.110.132:8085	—	2026-04-01
URL	http://144.172.110.132:8085/api/upload-file	—	2026-04-01
URL	http://144.172.110.132:8085/upload	—	2026-04-01
URL	http://144.172.110.132:8086	—	2026-04-01
URL	http://144.172.110.132:8086/upload	—	2026-04-01
URL	http://144.172.110.132:8087	—	2026-04-01
URL	http://144.172.110.132:8087/api/log	—	2026-04-01
URL	http://144.172.110.132:8087/api/notify	—	2026-04-01
URL	http://api.npoint.io/77363e668161581fb2de	—	2026-04-01
URL	http://static.cloudzy.com	—	2026-04-01
URL	https://api.npoint.io/77363e668161581fb2de	—	2026-04-01
domain	jsonkeeper.com	—	2026-04-01
domain	npoint.io	—	2026-04-01
hostname	132.110.172.144.static.cloudzy.com	—	2026-04-01
hostname	api.npoint.io	—	2026-04-01

References (1)

↗ https://threatprophet.com/posts/2026-03-26-triple-fork/