DPRK Contagious Interview Malware in SVG Images

Elastic Security Labs has identified a new DPRK-aligned campaign, tracked as REF9403 and attributed to the Contagious Interview group, targeting developers through fake job opportunities on platforms like Slack. The attack involves socially engineering targets into running trojanized 'coding challenge' repositories. These repositories contain malicious logic hidden within SVG flag images using steganography, which reassembles into a multi-stage payload when the project is executed.

The infection chain deploys OTTERCOOKIE, a comprehensive malware package that functions as a browser credential and cryptocurrency wallet stealer, a file exfiltrator, and a Socket.IO-based Remote Access Trojan (RAT). This campaign highlights the continued focus of North Korean actors on the developer ecosystem, seeking to leverage individual compromises for broader supply chain access and financial theft.

The malware exhibits high technical sophistication by using custom Base64 decoding, obfuscation via obfuscator.io, and cross-platform capabilities targeting Windows, macOS, and Linux. For organizations, a single developer's participation in a fake interview can lead to the total compromise of credentials, source code, and cloud environment access.