StoatWaffle is malware adopted around December 2025 by WaterPlum Team 8, a North Korea-related cluster associated with the Contagious Interview campaign. Operators used blockchain-themed projects as decoys within fake-recruitment infection flows, presenting malicious activity as legitimate work involving cryptocurrency or software development. The cluster introduced StoatWaffle after previously relying mainly on OtterCookie, marking a change in the payloads used behind the same broader social-engineering approach and campaign infrastructure.