# Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403)

> Elastic Security Labs uncovered a DPRK-aligned Contagious Interview (Famous Chollima) campaign, tracked as REF9403, trojanizing Next.js e-commerce GitHub repositories with fake job-interview lures to target software developers. A novel technique hides malware payload fragments as Base64 chunks in HTML comments inside country-flag SVG assets, reassembled alphabetically by client-side JavaScript and executed via eval(). The resulting implant blends OTTERCOOKIE and BEAVERTAIL capabilities into a four-stage payload chain covering browser/crypto-wallet credential theft, sensitive-file exfiltration, a Socket.IO-based remote access trojan, and clipboard monitoring plus a Windows PE dropper, across Windows, macOS, and Linux, with zero AV detections at discovery.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1450
- **ID:** TL-2026-1450
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 26, 2026, a member of the Elastic Security Labs community Slack was approached by a user calling themselves "Maxwell" with a fake job posting and a coding-challenge assignment: clone and run a private Next.js e-commerce repository (variously named next-ecommerce-private-main, shopping-platform-main, ecommerce-platform, shop-main) and report back. This social-engineering vector is consistent with the long-running DPRK-aligned Contagious Interview operation (also tracked as Famous Chollima, a financially-motivated subgroup of the broader Lazarus Group umbrella) that has targeted software developers and Web3/crypto engineers since at least 2023 via fake recruiters, coding assignments, and video-call "ClickFix" lures.

What differentiates REF9403 from prior Contagious Interview waves is the delivery mechanism for the second-stage payload: rather than embedding an obviously malicious dependency or a plaintext loader, the trojanized repository ships a directory of ordinary-looking country-flag SVG images (e.g. AE.svg, AF.svg) whose HTML comment blocks each carry a small Base64-encoded fragment of the actual payload. A bundled script, serverValidation.js, enumerates every SVG in the assets directory at server start, extracts the comment-embedded fragments, sorts the files alphabetically to guarantee correct fragment order, concatenates them, and feeds the result through a custom decoder function named Check() rather than a standard base64 API (Buffer.from() or atob()) specifically to dodge static/behavioral detections that hook those calls. The reconstructed script is then executed with eval(), and the whole chain fires automatically the moment the victim runs npm run dev or npm start on the "coding challenge," requiring no further victim interaction. The delivered JavaScript is additionally hardened with obfuscator.io (string-array extraction, index-based lookups, self-mutating arrays, and opaque predicate loops such as while(!![])), and at time of discovery the payload had zero detections across major antivirus engines.

Once reconstructed and executing, the implant unfolds a four-stage payload chain that fuses previously-distinct OTTERCOOKIE and BEAVERTAIL tradecraft into one convergent tool:

Stage 1 masquerades its process title as npm-cache and harvests browser-stored credentials (Login Data), autofill data (Web Data), and cryptocurrency-wallet extension storage across Chrome, Edge, LT Browser, and Brave on Windows (%LOCALAPPDATA%), macOS (~/Library/Application Support/), and Linux (~/.config/), plus the macOS system keychain (~/Library/Keychains/login.keychain-db). It enumerates roughly 25 wallet extensions including MetaMask, Phantom, Rabby, Keplr, Solflare, UniSat, TronLink, OKX Wallet, Core, and Exodus, and uploads the harvest to /upload and /cldbs on ldb.rightwidth[.]dev.

Stage 2 recursively scans the filesystem for sensitive content — *.env*, *.doc*, *.pdf, *.md, *.pem, *.secret, *.json, *.ts, *.js, shell histories, and archives — while deliberately excluding node_modules, vendor directories, and configuration paths for AI coding tools (.claude, .cursor, .windsurf) to reduce noise and avoid tipping off AI-assisted developer workflows. On Windows it enumerates every mounted drive via wmic logicaldisk get name; on macOS/Linux it scopes to the home directory. Captured files are uploaded unencrypted via POST to /upload on upload.rightwidth[.]dev.

Stage 3 establishes a persistent Socket.IO-over-HTTPS command channel to controller.rightwidth[.]dev, enforcing single-instance execution with a PID lock file at C:\Users\[user]\.npm\vhost.ctl. Before beaconing it performs VM/sandbox reconnaissance (wmic computersystem get model,manufacturer on Windows, system_profiler SPHardwareDataType on macOS, /proc/cpuinfo on Linux) and tags detected virtual-machine victims with a (VM) prefix in its registration beacon rather than aborting, sending host details to /api/service/process/<uid> and maintaining an operator logging channel at /api/service/makelog. The operator issues arbitrary shell commands over a command Socket.IO event, which the implant executes via Node's child_process.exec() and returns as a message event, giving full interactive remote code execution.

Stage 4 layers on clipboard surveillance (polling every 500ms via pbpaste on macOS and a spawned PowerShell Get-Clipboard on Windows, exfiltrated to /api/service/makelog/) and, on Windows, a dropper that pulls three additional binaries disguised as .txt files from file.rightwidth[.]dev via curl, renames them to .exe (hostService.exe, printSvc.exe, dhcpSvc.exe), and executes them — extending the compromise beyond the JavaScript implant into native second-stage tooling.

The broader Contagious Interview/Famous Chollima cluster has been observed running this playbook at scale: parallel reporting describes concurrent waves using front companies, JSON-storage-service payload delivery, and hundreds of malicious npm packages to spread OtterCookie, with wallet-key exfiltration campaigns netting DPRK operators up to an estimated $12M in the first three months of 2026 alone. This confirms REF9403 is one technique variant within an active, well-resourced, revenue-generating state campaign rather than an isolated incident, and organizations that unknowingly employ or contract compromised developers face material supply-chain risk from any code or credentials those developers touch.

## MITRE ATT&CK

- T1566 Phishing
- T1195 Supply Chain Compromise
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1001.002 Steganography
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1025 Data from Removable Media
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft
- T1585.001 Social Media Accounts
- T1583.001 Domains
- T1589.003 Employee Names

## Sources

- [Contagious Interview: Malware Hidden in SVG Steganography](https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography)
- [Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie](https://www.silentpush.com/blog/contagious-interview-front-companies/)
- [North Korea actors use OtterCookie malware in Contagious Interview campaign](https://securityaffairs.com/172382/malware/north-korea-linked-actors-using-ottercookie-backdoor.html)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery](https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/)
- [North Korean fake IT worker tradecraft exposed](https://www.csoonline.com/article/4143199/north-korean-fake-it-worker-tradecraft-exposed.html)
- [Contagious Interview campaign expands with 197 npm packages spreading new OtterCookie malware](https://securityaffairs.com/185170/apt/contagious-interview-campaign-expands-with-197-npm-ppackages-spreading-new-ottercookie-malware.html)
- [Latest Contagious Interview malware campaign abuses Microsoft VSCode Tasks](https://opensourcemalware.com/blog/contagious-interview-vscode)
- [BeaverTail and OtterCookie evolve with a new Javascript module](https://blog.talosintelligence.com/beavertail-and-ottercookie/)
- [Contagious Interview | lazarus.day actor profile](https://lazarus.day/actors/contagiousinterview/)
- [Famous Chollima | lazarus.day actor profile](https://lazarus.day/actors/famouschollima/)
- [North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign](https://devops.com/north-korea-expands-the-reach-of-polinrider-supply-chain-attack-campaign/)
- [Inside Lazarus: How North Korea uses AI to industrialize attacks on developers](https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1450