Key Takeaways
- North Korean state‑sponsored hackers tied to the “Contagious Interview” campaign are using SVG‑based steganography to hide malware in seemingly legitimate developer projects.
- The attack begins with fake job postings on platforms like Slack, luring targets into completing a trojanized coding challenge.
- Malicious payloads are split into Base64 fragments embedded in HTML comments of SVG flag images and reconstructed by a JavaScript loader (“serverValidation.js”).
- The final four‑stage payload aligns with the OTTERCOOKIE framework: browser and crypto‑wallet stealers, file exfiltrator, Socket.IO‑based RAT, and clipboard thief.
- OTTERCOOKIE has evolved from a simple remote‑command tool into a modular spyware suite that also harvests AI‑coding‑tool extensions (e.g., .claude, .cursor).
- Overlaps with malware spread via bogus npm packages indicate the threat actors employ multiple infection vectors.
- Compromising a single developer can provide a foothold for far‑reaching supply‑chain attacks against downstream organizations.
- Security teams should monitor developer environments for unexpected SVG files, Base64 strings in comments, and anomalous Socket.IO connections.
Campaign Overview and Threat Actor Attribution
The Contagious Interview operation, active since at least December 2022, has resurfaced with a new twist: North Korean threat actors are concealing malicious code inside SVG image files through steganography. Elastic Security Labs linked this activity to the Democratic People’s Republic of Korea (DPRK) and tracked it under the identifier REF9403. The campaign’s primary goal remains the theft of sensitive data and cryptocurrency assets from software developers, a group prized for its access to valuable codebases and internal systems. By exploiting the trust developers place in coding challenges and job‑screening processes, the attackers gain an initial foothold that can be leveraged for broader supply‑chain compromises.
Elastic Security Labs’ Findings and Reporting
In a report shared with The Hacker News, Elastic Security Labs detailed how the attackers delivered a four‑stage payload that mirrors the OTTERCOOKIE malware family. The lab discovered the campaign after observing phishing‑style messages in a community Slack workspace operated by the Dutch enterprise search and observability platform. The messages, posted by a user named “Maxwell” in the #jobs channel in late May 2026, advertised a senior developer role focused on upgrading an e‑commerce stack to Next.js (v14), NestJS, PostgreSQL, Auth.js, and Stripe integration. This lure represents a novel initial‑access vector not previously documented in earlier Contagious Interview waves.
Social Engineering Lure via Slack
The fake job posting prompted interested developers to move the conversation into direct messages, where they were instructed to complete a coding assessment as part of the hiring process—a classic ploy used in Contagious Interview campaigns. The assessment required cloning a GitHub repository that appeared to be a legitimate starter project but actually contained trojanized code. By framing the malicious payload as a routine technical test, the attackers lowered the target’s guard and increased the likelihood of execution.
Trojanized Repository and Coding Challenge
Once the target cloned the repository, they were directed to run a setup script or build command that would execute the hidden malware. The repository itself looked fully functional, containing typical project scaffolding, dependency files, and documentation. However, embedded within the assets folder were numerous SVG files depicting country flags (e.g., AE.svg, AF.svg). These images served as carriers for the malicious payload, allowing the attackers to blend malicious code with innocuous‑looking resources.
Steganographic Concealment in SVG Files
Each SVG file contained an HTML comment block that held Base64‑encoded fragments of the ultimate malware. Because SVGs are XML‑based, comments are ignored by renderers but remain accessible to scripts that parse the file. The attackers split the payload across many such fragments, ensuring that no single file appeared suspiciously large or anomalous. When the project’s build process executed, a dedicated JavaScript loader collected these fragments, decoded them, and reassembled the complete malicious binary in memory.
Payload Assembly and Execution Mechanism
The reassembly routine resided in a file named “serverValidation.js,” which was invoked during the project’s startup or build phase. This loader ensured that the malware ran automatically each time the server or development environment booted, establishing persistence without needing additional user interaction. Elastic noted that the resulting payload shares substantial code overlap with OTTERCOOKIE, a cross‑platform malware family first identified in September 2024. By leveraging a legitimate‑looking build step, the attackers evaded many endpoint‑detect‑and‑response (EDR) tools that focus on malicious binaries rather than seemingly innocent project files.
OTTERCOOKIE Malware Evolution and Capabilities
OTTERCOOKIE began as a modest utility for executing remote commands and searching for cryptocurrency keys. Over time, it has morphed into a modular espionage platform capable of: harvesting credentials from web browsers and crypto wallets; exfiltrating files matching a predefined set of extensions (including documents, source code, and configuration files); establishing a Socket.IO‑based reverse shell for persistent remote control; capturing clipboard contents; and dropping additional Windows executables for further payload delivery. Its modular architecture lets operators enable or disable specific functions based on the victim’s environment, making it highly adaptable.
Targeted Data and Specialized Extensions
Beyond typical credentials, OTTERCOOKIE actively seeks artifacts related to AI‑assisted development tools. The malware searches for files with extensions such as .claude, .cursor, .gemini, .windsurf, .pearai, and .llama—folders and configuration files used by popular AI coding assistants. This indicates that the threat actors are expanding their collection scope to capture proprietary prompts, model fine‑tuning data, and other intellectual property that could accelerate their own AI‑driven offensive capabilities.
Connections to Other Malware Distribution Vectors
Elastic’s analysis also revealed functional similarities between the SVG‑based payload and malware previously spread via fraudulent npm packages masquerading as Rollup polyfill tooling. This overlap suggests that the North Korean group is employing a multi‑pronged strategy: using fake job offers, compromised open‑source repositories, and malicious package registries to maximize infection chances. By diversifying vectors, they increase the likelihood that at least one approach will bypass a target’s defenses.
Implications for Developers and Supply‑Chain Security
The success of this campaign underscores how compromising a single developer can serve as a springboard for far‑reaching supply‑chain attacks. A breached developer workstation may expose source code, build pipelines, credential stores, and internal artifact repositories, enabling threat actors to inject malicious updates into downstream products or services. Organizations must therefore treat developer environments as high‑value assets, applying strict code‑review policies, monitoring for anomalous SVG or Base64 content, restricting unauthorized outbound connections (especially Socket.IO), and employing behavioral analytics to detect subtle signs of post‑exploitation activity.
Conclusion
The Contagious Interview campaign’s latest iteration illustrates the evolving sophistication of state‑sponsored actors targeting the software development lifecycle. By embedding malicious payloads inside innocuous‑looking SVG files and leveraging social engineering lures, North Korean hackers have demonstrated a capable, low‑observable technique for stealing credentials, cryptocurrency, and valuable intellectual property. Vigilance, robust endpoint monitoring, and a zero‑trust stance toward third‑party code are essential to mitigate such threats.