OtterCookie is a JavaScript and Node.js remote-access trojan associated with DPRK-linked Contagious Interview activity. It uses Socket.IO for command-and-control and supports collection of credentials, cryptocurrency-wallet data, sensitive files, clipboard contents, keystrokes, screenshots, and active workspace information. Documented versions perform periodic workstation monitoring, track connected victims, and upload stolen data over HTTP. Related server-side functionality handles client logging, operator tasking, database collection, file retrieval, and uploads across Windows, macOS, and Linux targets.