BeaverTail is a cross-platform JavaScript information stealer used in DPRK-linked Contagious Interview operations. Trojanized coding projects and malicious npm packages deliver it to Windows and macOS developers, often as part of fake recruitment exercises. Documented versions steal Chromium credentials and data from cryptocurrency-wallet and password-manager extensions, communicate with operator infrastructure, and can lead to the InvisibleFerret RAT. Later reporting also describes RAT-first variants with WebSocket command channels and operator-directed collection, showing substantial evolution in the family. MITRE ATT&CK S1246.