Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403) — Threadlinqs Intelligence
As of 2026-07-18, Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403) is a high-severity malware threat attributed to Contagious Interview (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 34 indicators of compromise.
Threat ID: TL-2026-1450 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Contagious Interview · North Korea (DPRK) · FINANCIAL
Elastic Security Labs uncovered a DPRK-aligned Contagious Interview (Famous Chollima) campaign, tracked as REF9403, trojanizing Next.js e-commerce GitHub repositories with fake job-interview lures to
On May 26, 2026, a member of the Elastic Security Labs community Slack was approached by a user calling themselves "Maxwell" with a fake job posting and a coding-challenge assignment: clone and run a private Next.js e-commerce repository (variously named next-ecommerce-private-main, shopping-platform-main, ecommerce-platform, shop-main) and report back. This social-engineering vector is consistent with the long-running DPRK-aligned Contagious Interview operation (also tracked as Famous Chollima, a financially-motivated subgroup of the broader Lazarus Group umbrella) that has targeted software developers and Web3/crypto engineers since at least 2023 via fake recruiters, coding assignments, and video-call "ClickFix" lures.
What differentiates REF9403 from prior Contagious Interview waves is the delivery mechanism for the second-stage payload: rather than embedding an obviously malicious dependency or a plaintext loader, the trojanized repository ships a directory of ordinary-looking country-flag SVG images (e.g. AE.svg, AF.svg) whose HTML comment blocks each carry a small Base64-encoded fragment of the actual payload. A bundled script, serverValidation.js, enumerates every SVG in the assets directory at server start, extracts the comment-embedded fragments, sorts the files alphabetically to guarantee correct fragment order, concatenates them, and feeds the result through a custom decoder function named Check() rather than a standard base64 API (Buffer.from() or atob()) specifically to dodge static/behavioral detections that hook those calls. The reconstructed script is then executed with eval(), and the whole chain fires automatically the moment the victim runs npm run dev or npm start on the "coding challenge," requiring no further victim interaction. The delivered JavaScript is additionally hardened with obfuscator.io (string-array extraction, index-based lookups, self-mutating arrays, and opaque predicate loops such as while(!![])), and at time of discovery the payload had zero detections across major antivirus engines.
Once reconstructed and executing, the implant unfolds a four-stage payload chain that fuses previously-distinct OTTERCOOKIE and BEAVERTAIL tradecraft into one convergent tool:
Stage 1 masquerades its process title as npm-cache and harvests browser-stored credentials (Login Data), autofill data (Web Data), and cryptocurrency-wallet extension storage across Chrome, Edge, LT Browser, and Brave on Windows (%LOCALAPPDATA%), macOS (~/Library/Application Support/), and Linux (~/.config/), plus the macOS system keychain (~/Library/Keychains/login.keychain-db). It enumerates roughly 25 wallet extensions including MetaMask, Phantom, Rabby, Keplr, Solflare, UniSat, TronLink, OKX Wallet, Core, and Exodus, and uploads the harvest to /upload and /cldbs on ldb.rightwidth[.]dev.
Stage 2 recursively scans the filesystem for sensitive content — *.env*, *.doc*, *.pdf, *.md, *.pem, *.secret, *.json, *.ts, *.js, shell histories, and archives — while deliberately excluding node_modules, vendor directories, and configuration paths for AI coding tools (.claude, .cursor, .windsurf) to reduce noise and avoid tipping off AI-assisted developer workflows. On Windows it enumerates every mounted drive via wmic logicaldisk get name; on macOS/Linux it scopes to the home directory. Captured files are uploaded unencrypted via POST to /upload on upload.rightwidth[.]dev.
Stage 3 establishes a persistent Socket.IO-over-HTTPS command channel to controller.rightwidth[.]dev, enforcing single-instance execution with a PID lock file at C:\Users\[user]\.npm\vhost.ctl. Before beaconing it performs VM/sandbox reconnaissance (wmic computersystem get model,manufacturer on Windows, system_profiler SPHardwareDataType on macOS, /proc/cpuinfo on Linux) and tags detected virtual-machine victims with a (VM) prefix in its registration beacon rather than aborting, sending host details to /api/service/process/<uid> and maintaining an operator logging channel at
Weaknesses (CWE)
CWE-506, CWE-912, CWE-522
Target sectors: technology, software development, cryptocurrency, web3, fintech, ecommerce
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 34 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1195, T1059.007, T1204.002, T1059.001, T1505, T1027, T1001.002, T1036.005, T1497.001