North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges.
“Any user who ran the project ended up with a four-stage payload aligned with OtterCookie: a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based remote access trojan (RAT), and a clipboard stealer,” Elastic Security Labs said in a report shared with The Hacker News.
The findings once again highlight the continued targeting of software developers by state-sponsored hackers aligned with the Democratic People’s Republic of Korea (DPRK) with an aim to steal sensitive data and plunder cryptocurrency wallets. The activity is being tracked under the moniker REF9403.
The cybersecurity arm of the Dutch enterprise search and observability platform said it discovered the campaign after the threat actors targeted members of its community Slack workspace with social engineering lures for purported job offers, highlighting a new initial access avenue not previously documented in attacks associated with Contagious Interview, a sophisticated social engineering operation ongoing since at least December 2022.
That said, this is not the first time North Korean adversaries have relied on Slack for impersonation and social-engineering purposes. Earlier this year, the threat actors were observed creating a Slack workspace and inviting the maintainer of the Axios npm package to schedule a bogus meeting that led to the compromise of the JavaScript library. The activity was subsequently attributed to UNC1069.
“Our team has personally seen DPRK use a public Discord server that was for the blockchain engineering community then deploy malware to victims,” Daniel Stepanic, threat researcher engineer at Elastic, told The Hacker News. “This is part of their social engineering workflow, picking public social media platforms (GitHub, Slack, Discord, LinkedIn, Telegram), impersonating users/brands, then trying to infect users once they have built up a credible reputation with the user.”
Stepanic that the attacks are effective and likely working. “We don’t have visibility into the volume, but we have seen a user run the challenge and come back saying something felt off, and the job/project recruiter disappeared,” the researcher added. “We have seen a couple repos published in GitHub by possible victims, we believe the users aren’t aware of the backdoor. Ultimately, since this social engineering approach has persisted with minimal adjustment is itself evidence of its effectiveness.”
The messages, posted by a user named Maxwell on the #jobs Slack channel in late May 2026, sought an experienced developer to help with upgrading their e-commerce platform to a “modern, scalable architecture using Next.js (v14), NestJS, PostgreSQL, and Auth.js” along with Stripe integration.
Those who expressed interest in the opportunity were moved into direct messages that instructed them to complete a coding assessment as part of the job offer, a standard ploy observed in Contagious Interview campaigns. The assignment involved executing a trojanized repository containing malware designed to exfiltrate valuable data and configuring a Socket.IO backdoor.
Specifically, the repositories distributed as part of the scheme incorporate fully functional code but also embed malicious code in the form of SVG images to sidestep detection.
“While these legitimate-looking projects run perfectly fine, the malicious code is triggered silently behind-the-scenes,” Elastic said. “The payloads are split into base64 fragments inside HTML comments across every SVG flag image inside an assets directory. These files appear to be normal images of country flags (AE.svg, AF.svg), but each file contains an injected comment block with Base64-encoded data.”
The payload is then assembled together by a JavaScript file (“serverValidation.js”) present in the repository. The attack chain is engineered such that the malware is executed on each server boot. Elastic said the main payload shares overlap with OtterCookie, a cross-platform malware that first emerged in September 2024.
OtterCookie “evolved from a basic tool for executing remote commands and searching for crypto keys into a modular program capable of broader data theft with a capability to check for VM environments, install communication clients like socket.io for C2, exfiltrate information, executes arbitrary shell commands, load other modules to collect specific intended data and reports results,” Microsoft noted back in March.
The malware incorporates four distinct modules that allow it to harvest data from web browsers and cryptocurrency wallets, collect files matching a specific list of extensions, facilitate persistent remote control using a Socket.IO-based trojan that can execute shell commands, capture clipboard content, and drop Windows executables.
Among the files gathered by OtterCookie include artificial intelligence (AI) coding tooling extensions such as .claude, .cursor, .gemini, .windsurf, .pearai, and .llama, suggesting the threat actor is actively refining its arsenal to hoover as much information as possible.
It’s worth noting that the malware also exhibits some functional overlaps with a data stealer and trojan distributed via bogus npm packages masquerading as Rollup polyfill tooling, suggesting the threat actors are pursuing multiple vectors for propagation.
“This campaign reinforces that developers remain a prime target, where the compromise of a single individual can provide the initial access needed to enable far-reaching supply chain attacks against downstream organizations,” Elastic said. “The success of these operations underscores how compromising an individual developer can provide a path to much broader organizational impact.”
