Fake Coding Tests Deliver OtterCookie Malware Hidden in SVG Flag Images

North Korean threat actors linked to the Contagious Interview campaign have been observed using steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. Elastic Security Labs reported that any user who ran the trojanized project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based remote access trojan (RAT), and a clipboard stealer.

The activity, tracked as REF9403, targeted members of Elastic’s community Slack workspace with social engineering lures for purported job offers. The messages, posted by a user named Maxwell on the #jobs Slack channel in late May 2026, sought an experienced developer to help upgrade an e-commerce platform. Those who expressed interest were instructed to complete a coding assessment involving a trojanized repository containing malware designed to exfiltrate data and configure a Socket.IO backdoor.

The repositories incorporate fully functional code but embed malicious code in SVG images to sidestep detection. The payloads are split into base64 fragments inside HTML comments across every SVG flag image in an assets directory. A JavaScript file (serverValidation.js) assembles the payload, and the malware executes on each server boot.

OtterCookie, which first emerged in September 2024, has evolved into a modular program capable of broader data theft, including checking for VM environments, installing Socket.IO for C2, exfiltrating information, executing arbitrary shell commands, and loading other modules. The malware harvests data from web browsers and cryptocurrency wallets, collects files matching specific extensions, facilitates persistent remote control, captures clipboard content, and drops Windows executables. It also targets AI coding tooling extensions such as .claude, .cursor, .gemini, .windsurf, .pearai, and .llama.

Elastic noted that the campaign reinforces that developers remain a prime target, where the compromise of a single individual can provide initial access for far-reaching supply chain attacks against downstream organizations.