Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403)
Contagious Interview (DPRK) Uses SVG Steganography to (TL-2026-1450), also tracked as REF9403, is a high-severity malware campaign, first published 2026-07-18. It is attributed to Contagious Interview (North Korea) with high confidence, affects Node.js / npm ecosystem Next.js e-commerce developer take-home, maps to 28 MITRE ATT&CK techniques (T1001.002, T1005, T1025), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-1450
- Threat ID
- TL-2026-1450
- Also known as
- REF9403, Contagious Interview SVG Steganography Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution
- Contagious Interview
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, web3, fintech, ecommerce
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in Contagious Interview (DPRK) Uses SVG Steganography to
Malware and tooling: BeaverTail - S1246, InvisibleFerret - S1245, OtterCookie, Socket.IO
Elastic Security Labs uncovered a DPRK-aligned Contagious Interview (Famous Chollima) campaign, tracked as REF9403, trojanizing Next.js e-commerce GitHub repositories with fake job-interview lures to target software developers. A novel technique hides malware payload fragments as Base64 chunks in HTML comments inside country-flag SVG assets, reassembled alphabetically by client-side JavaScript and executed via eval(). The resulting implant blends OTTERCOOKIE and BEAVERTAIL capabilities into a four-stage payload chain covering browser/crypto-wallet credential theft, sensitive-file exfiltration, a Socket.IO-based remote access trojan, and clipboard monitoring plus a Windows PE dropper, across Windows, macOS, and Linux, with zero AV detections at discovery.
How Contagious Interview (DPRK) Uses SVG Steganography to works
On May 26, 2026, a member of the Elastic Security Labs community Slack was approached by a user calling themselves "Maxwell" with a fake job posting and a coding-challenge assignment: clone and run a private Next.js e-commerce repository (variously named next-ecommerce-private-main, shopping-platform-main, ecommerce-platform, shop-main) and report back. This social-engineering vector is consistent with the long-running DPRK-aligned Contagious Interview operation (also tracked as Famous Chollima, a financially-motivated subgroup of the broader Lazarus Group umbrella) that has targeted software developers and Web3/crypto engineers since at least 2023 via fake recruiters, coding assignments, and video-call "ClickFix" lures.
What differentiates REF9403 from prior Contagious Interview waves is the delivery mechanism for the second-stage payload: rather than embedding an obviously malicious dependency or a plaintext loader, the trojanized repository ships a directory of ordinary-looking country-flag SVG images (e.g. AE.svg, AF.svg) whose HTML comment blocks each carry a small Base64-encoded fragment of the actual payload. A bundled script, serverValidation.js, enumerates every SVG in the assets directory at server start, extracts the comment-embedded fragments, sorts the files alphabetically to guarantee correct fragment order, concatenates them, and feeds the result through a custom decoder function named Check() rather than a standard base64 API (Buffer.from() or atob()) specifically to dodge static/behavioral detections that hook those calls. The reconstructed script is then executed with eval(), and the whole chain fires automatically the moment the victim runs npm run dev or npm start on the "coding challenge," requiring no further victim interaction. The delivered JavaScript is additionally hardened with obfuscator.io (string-array extraction, index-based lookups, self-mutating arrays, and opaque predicate loops such as while(!![])), and at time of discovery the payload had zero detections across major antivirus engines.
Once reconstructed and executing, the implant unfolds a four-stage payload chain that fuses previously-distinct OTTERCOOKIE and BEAVERTAIL tradecraft into one convergent tool:
Stage 1 masquerades its process title as npm-cache and harvests browser-stored credentials (Login Data), autofill data (Web Data), and cryptocurrency-wallet extension storage across Chrome, Edge, LT Browser, and Brave on Windows (%LOCALAPPDATA%), macOS (~/Library/Application Support/), and Linux (~/.config/), plus the macOS system keychain (~/Library/Keychains/login.keychain-db). It enumerates roughly 25 wallet extensions including MetaMask, Phantom, Rabby, Keplr, Solflare, UniSat, TronLink, OKX Wallet, Core, and Exodus, and uploads the harvest to /upload and /cldbs on ldb.rightwidth[.]dev.
Stage 2 recursively scans the filesystem for sensitive content — *.env*, *.doc*, *.pdf, *.md, *.pem, *.secret, *.json, *.ts, *.js, shell histories, and archives — while deliberately excluding node_modules, vendor directories, and configuration paths for AI coding tools (.claude, .cursor, .windsurf) to reduce noise and avoid tipping off AI-assisted developer workflows. On Windows it enumerates every mounted drive via wmic logicaldisk get name; on macOS/Linux it scopes to the home directory. Captured files are uploaded unencrypted via POST to /upload on upload.rightwidth[.]dev.
Stage 3 establishes a persistent Socket.IO-over-HTTPS command channel to controller.rightwidth[.]dev, enforcing single-instance execution with a PID lock file at C:\Users\[user]\.npm\vhost.ctl. Before beaconing it performs VM/sandbox reconnaissance (wmic computersystem get model,manufacturer on Windows, system_profiler SPHardwareDataType on macOS, /proc/cpuinfo on Linux) and tags detected virtual-machine victims with a (VM) prefix in its registration beacon rather than aborting, sending host details to /api/service/process/<uid> and maintaining an operator logging channel at /api/service/makelog. The operator issues arbitrary shell commands over a command Socket.IO event, which the implant executes via Node's child_process.exec() and returns as a message event, giving full interactive remote code execution.
Stage 4 layers on clipboard surveillance (polling every 500ms via pbpaste on macOS and a spawned PowerShell Get-Clipboard on Windows, exfiltrated to /api/service/makelog/) and, on Windows, a dropper that pulls three additional binaries disguised as .txt files from file.rightwidth[.]dev via curl, renames them to .exe (hostService.exe, printSvc.exe, dhcpSvc.exe), and executes them — extending the compromise beyond the JavaScript implant into native second-stage tooling.
The broader Contagious Interview/Famous Chollima cluster has been observed running this playbook at scale: parallel reporting describes concurrent waves using front companies, JSON-storage-service payload delivery, and hundreds of malicious npm packages to spread OtterCookie, with wallet-key exfiltration campaigns netting DPRK operators up to an estimated $12M in the first three months of 2026 alone. This confirms REF9403 is one technique variant within an active, well-resourced, revenue-generating state campaign rather than an isolated incident, and organizations that unknowingly employ or contract compromised developers face material supply-chain risk from any code or credentials those developers touch.
MITRE ATT&CK techniques used in TL-2026-1450
command-and-control
Collection
T1005 Data from Local System; T1025 Data from Removable Media; T1115 Clipboard Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
Persistence
T1505 Server Software Component
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts
Reconnaissance
Impact
Affected products and versions in Contagious Interview (DPRK) Uses SVG Steganography to
- Node.js / npm ecosystem — Next.js e-commerce developer take-home repositories (trojanized)
Vulnerable versions: any repository matching next-ecommerce-private-main, shopping-platform-main, ecommerce-platform, shop-main naming pattern from Contagious Interview lures - Cross-platform — Windows, macOS, Linux developer workstations
Vulnerable versions: all versions targeted via social engineering, not a software vulnerability
Remediation for Contagious Interview (DPRK) Uses SVG Steganography to
Immediate actions
- Block C2 domains rightwidth[.]dev and all subdomains (ldb., upload., controller., file.) at DNS/perimeter firewall
- Block IOC IPs 195.26.248.212 and 188.40.64.61 at network perimeter
- Isolate and forensically image any host that ran npm run dev/npm start against an unvetted external repository claiming to be an interview coding challenge
- Rotate all browser-saved credentials, cryptocurrency wallet keys, and API secrets on any potentially exposed developer workstation
- Hunt for process title npm-cache, PID lock file .npm\vhost.ctl, and binaries hostService.exe/printSvc.exe/dhcpSvc.exe
Workarounds
- Run all take-home coding-challenge repositories in an ephemeral container/VM with no access to production credentials or personal browser profiles
- Inspect SVG or image assets in unfamiliar repositories for embedded HTML comments and unusual JavaScript that parses asset directories at runtime
Longer-term hardening
- Mandate execution of unvetted take-home/interview coding assignments only inside disposable, network-isolated VMs or sandboxes, never on primary developer workstations
- Deploy EDR with behavioral detection for eval()-based dynamic code execution and unusual SVG/asset file reads at process startup
- Require code review / static analysis of any third-party repository before npm install or npm run in a candidate-assessment workflow
- Deploy DLP/network monitoring for Socket.IO C2-style beaconing and clipboard exfiltration patterns
- Educate hiring/recruiting and engineering staff on Contagious Interview social-engineering lures (fake recruiters, urgent coding challenges, requests to run code locally)
Weaknesses (CWE) in Contagious Interview (DPRK) Uses SVG Steganography to
CWE-506, CWE-912, CWE-522
Timeline of Contagious Interview (DPRK) Uses SVG Steganography to
- OTTERCOOKIE first discovered and documented by NTT Security as a new Contagious Interview payload.
- NVISO Labs reports Contagious Interview actors pivoting to JSON storage services for malware delivery, showing continued evolution of the loader chain.
- Security Affairs reports on continued OtterCookie backdoor use by North Korea-linked actors in the Contagious Interview campaign.
- Cisco Talos documents BeaverTail and OtterCookie evolving with a new shared JavaScript module, evidencing capability convergence between the two families.
- Microsoft Security publishes analysis of Contagious Interview malware delivered through fake developer job interviews.
- Silent Push reports Contagious Interview launching three front companies to distribute BeaverTail, InvisibleFerret, and OtterCookie.
- Reporting shows a parallel Contagious Interview wave abusing Microsoft VSCode Tasks as a delivery mechanism.
- A member of the Elastic Security Labs community Slack is approached by threat actor persona 'Maxwell' with a fake job posting and a coding-challenge assignment, marking the initial observation of the REF9403 SVG-steganography variant.
- Security Affairs reports the broader Contagious Interview campaign expanding to 197 malicious npm packages spreading a new OtterCookie variant.
- Elastic Security Labs publicly discloses the REF9403 SVG-steganography campaign, detailing the four-stage OTTERCOOKIE/BEAVERTAIL convergent payload chain.
Sources cited for Contagious Interview (DPRK) Uses SVG Steganography to
- Contagious Interview: Malware Hidden in SVG Steganography
- Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie
- North Korea actors use OtterCookie malware in Contagious Interview campaign
- Contagious Interview: Malware delivered through fake developer job interviews
- Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery
- North Korean fake IT worker tradecraft exposed
- Contagious Interview campaign expands with 197 npm packages spreading new OtterCookie malware
- Latest Contagious Interview malware campaign abuses Microsoft VSCode Tasks
- BeaverTail and OtterCookie evolve with a new Javascript module
- Contagious Interview | lazarus.day actor profile
- Famous Chollima | lazarus.day actor profile
- North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign
- Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
Threats related to Contagious Interview (DPRK) Uses SVG Steganography to
- OTTERCOOKIE Malware Hidden in SVG Flag Images Backdoors Developers via Fake Coding Tests (Contagious Interview / REF9403)
- North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials
- North Korea-Linked Contagious Interview Actors (REF9403) Hide OtterCookie-Aligned Malware in SVG Flag Images
Detection coverage for TL-2026-1450
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1450 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.