North Korea-Linked Contagious Interview Actors (REF9403) Hide OtterCookie-Aligned Malware in SVG Flag Images
North Korea-Linked Contagious Interview Actors (REF9403) (TL-2026-1452), also tracked as OtterCookie SVG Steganography Campaign, is a high-severity malware campaign, first published 2026-07-17. It is attributed to REF9403 (North Korea) with medium confidence, affects N/A (social-engineering / supply-chain vector) Software developer, maps to 33 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1452
- Threat ID
- TL-2026-1452
- Also known as
- OtterCookie SVG Steganography Campaign, Contagious Interview AI-Tool Targeting Wave
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-17
- Last reviewed
- 2026-07-17
- Attribution
- REF9403
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, web3, software-development, fintech
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in North Korea-Linked Contagious Interview Actors (REF9403)
Malware and tooling: OtterCookie, Socket.IO-based RAT
North Korean threat actors tracked as REF9403, part of the Contagious Interview / DeceptiveDevelopment campaign, distribute fake coding-test job assignments via Slack #jobs channels containing trojanized repositories that conceal a four-stage OtterCookie-aligned payload using base64-encoded code hidden in HTML comments within SVG flag images (e.g. AE.svg, AF.svg). The malware steals browser credentials, crypto wallet data, and files (including AI coding tool configs for .claude, .cursor, .gemini, .windsurf, .pearai, .llama), and establishes a Socket.IO-based RAT for persistent remote access.
How North Korea-Linked Contagious Interview Actors (REF9403) works
REF9403 is a North Korea-aligned cluster operating within the broader Contagious Interview (also tracked as DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121, CL-STA-0240, MITRE ATT&CK Group G1052) supply-chain social-engineering campaign, active since at least November 2023 and assessed by ESET (November 2024) to overlap with Lazarus Group cryptocurrency-theft operations. In this iteration, operators posted recruitment lures — using the persona "Maxwell" observed in late May 2026 in the Elastic Security community Slack workspace — advertising e-commerce platform upgrade contract work requiring Next.js, NestJS, PostgreSQL, Auth.js, and Stripe integration skills. Victims expressing interest are directed to a trojanized GitHub/GitLab/Bitbucket repository that appears to be a legitimate coding assignment.
The novel tradecraft in this wave is steganographic payload concealment inside SVG country-flag image assets (e.g. AE.svg, AF.svg) shipped as normal-looking UI assets within the fake project. Base64-encoded JavaScript fragments are hidden inside HTML comments in these SVG files; a companion script, serverValidation.js, reassembles the fragments into a working payload at runtime. Because the surrounding project code executes normally, the technique is designed to survive casual code review, and the malware re-triggers on every server/dev-environment boot, giving durable execution without an explicit persistence artifact in most cases.
The reassembled payload aligns with OtterCookie, a JavaScript-based, cross-platform (Windows/Linux/macOS) infostealer-RAT that emerged in September 2024 and has been iteratively hardened by the operators (Microsoft documented a heavily obfuscated October 2025 variant using encoded index lookups and shuffled arrays to defeat static/signature analysis). The four observed payload stages are: (1) a browser-credential and cryptocurrency-wallet stealer targeting Chrome/Brave stores and wallet mnemonic/private-key artifacts; (2) a file stealer that specifically enumerates and exfiltrates AI coding-assistant configuration directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) alongside classic credential stores (KeePass, 1Password, SSH/GPG keys, .env files); (3) a Socket.IO-based remote access trojan that registers the infected host with a C2 endpoint, performs VM/sandbox detection, fingerprints the host (hostname, network identifiers, OS, public IP), and executes arbitrary shell commands tasked by the operator; and (4) a clipboard-monitoring/screenshot module (leveraging benign-looking auxiliary npm packages such as node-global-key-listener and screenshot-desktop) for ambient surveillance and credential capture.
The campaign's infrastructure model chains GitHub-hosted trojanized repos to Vercel-hosted staging pages (previously observed: tetrismic.vercel.app) for payload delivery, with URL-shortening services (short.gy) used to obscure links, before handing off to attacker C2 for tasking and exfiltration via axios-based multipart form-data uploads. Related npm-based waves of the same operator infrastructure (Socket, reported concurrently) added 197 new malicious/typosquatted packages (e.g. tailwind-magic, node-tailwind, node-tailwind-magic, react-modal-select) impersonating tailwind-merge and accumulating over 31,000 downloads, published from the GitHub account stardev0914 (18 repositories) — illustrating the same actor set's parallel supply-chain-poisoning line of effort alongside the direct-interview-lure vector used against this specific target set.
The explicit targeting of AI coding-tool configuration directories is a novel objective for this cluster: harvesting .claude/.cursor/.gemini/.windsurf/.pearai/.llama config and credential material gives the operators access to API keys, MCP/tool tokens, and workspace context that can be pivoted into further supply-chain compromise of downstream projects the victim works on — consistent with REF9403's overarching goal of using compromised individual developers as a foothold into their employers' build/CI pipelines and codebases.
No CVE is associated with this activity; it is a social-engineering and supply-chain delivery chain rather than a vulnerability exploit. Motivation is assessed as primarily financial (cryptocurrency and credential theft funding the DPRK regime) with a secondary espionage/access-broker dimension via harvested developer secrets (cloud/API tokens, signing keys) that enable further downstream compromise.
MITRE ATT&CK techniques used in TL-2026-1452
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Collection
T1113 Screen Capture; T1115 Clipboard Data
Persistence
T1543 Create or Modify System Process; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Credential Access
T1555 Credentials from Password Stores
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities; T1683 Generate Content
Reconnaissance
T1589 Gather Victim Identity Information; T1593 Search Open Websites/Domains
Impact
Affected products and versions in North Korea-Linked Contagious Interview Actors (REF9403)
- N/A (social-engineering / supply-chain vector) — Software developer workstations (Windows, Linux, macOS)
Vulnerable versions: Any developer environment executing untrusted interview-assignment repositories - npm / open-source registries — Typosquatted packages (tailwind-magic, node-tailwind, node-tailwind-magic, react-modal-select, and related)
Vulnerable versions: All published malicious versions
Remediation for North Korea-Linked Contagious Interview Actors (REF9403)
Immediate actions
- Treat unsolicited job/recruitment DMs on Slack, LinkedIn, and Discord that lead to a 'coding test' repository as untrusted until vetted
- Never clone-and-run interview/assessment repositories outside an isolated VM, container, or throwaway sandbox with no access to real credentials or wallets
- Scan repository assets (including SVG/image files) for embedded HTML comments containing base64-encoded script content before execution
- Block execution of Node.js against non-.js asset extensions (.svg, .woff, .woff2, .png, .jpeg) at the endpoint/EDR level
- Revoke and rotate any credentials, API keys, cloud tokens, and crypto-wallet material that may have touched a machine used for an unvetted coding assignment
- Audit AI coding-tool config directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) for unexpected exfiltration or tampering after any suspected compromise
Workarounds
- Manually inspect all SVG/image assets in third-party or recruitment-provided repositories for HTML comment blocks before allowing execution
- Disable auto-execution of VS Code tasks and workspace-trust prompts for repositories from unknown/unverified sources
Longer-term hardening
- Deploy EDR with behavioral detection for Socket.IO-based outbound C2 beaconing from developer workstations
- Enforce policy requiring interview/take-home coding exercises run only in disposable, network-isolated sandboxes provided by the employer
- Implement npm/package-registry allowlisting and typosquat detection (e.g. Socket, Snyk) in CI pipelines
- Establish security awareness training for engineering staff specifically covering fake-recruiter and Contagious Interview social-engineering patterns
- Monitor for anomalous clipboard-access, screenshot-capture, and keylogger-adjacent npm dependencies (node-global-key-listener, screenshot-desktop) introduced into developer environments
Weaknesses (CWE) in North Korea-Linked Contagious Interview Actors (REF9403)
CWE-506, CWE-912, CWE-829
Timeline of North Korea-Linked Contagious Interview Actors (REF9403)
- Contagious Interview / DeceptiveDevelopment campaign begins operating against software developers via fake recruitment lures.
- OtterCookie JavaScript-based infostealer/RAT first observed in the wild as part of the Contagious Interview toolset.
- ESET assesses overlap between DeceptiveDevelopment and Contagious Interview clusters, tying the activity to Lazarus Group cryptocurrency-theft operations.
- Reporting details North Korean actors targeting freelance developers on job platforms to deploy the same malware family.
- Microsoft observes a heavily obfuscated OtterCookie variant using encoded index lookups and shuffled arrays to defeat static analysis.
- NVISO documents Contagious Interview actors adopting JSON storage services as an additional malware delivery mechanism.
- Socket reports 197 new malicious/typosquatted npm packages (impersonating tailwind-merge) tied to the same operator infrastructure, exceeding 31,000 downloads, published via GitHub account stardev0914.
- Microsoft Security publishes a technical deep-dive on Contagious Interview TTPs, OtterCookie capabilities, and MITRE ATT&CK alignment.
- Operator persona 'Maxwell' posts recruitment lures for e-commerce platform upgrade work in the Elastic Security community Slack workspace.
- REF9403 wave identified distributing OtterCookie-aligned malware via SVG flag images with base64-encoded payloads hidden in HTML comments, newly targeting AI coding-tool configuration directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama).
Sources cited for North Korea-Linked Contagious Interview Actors (REF9403)
- Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images
- Contagious Interview: Malware delivered through fake developer job interviews
- Contagious Interview campaign expands with 197 npm packages spreading new OtterCookie malware
- Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121 (G1052)
- North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign
- North Korea actors use OtterCookie malware in Contagious Interview campaign
- Contagious Interview: Tracking the VS Code Tasks Vector
- Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery
- North Korean Hackers Target Freelance Developers in Job Scam to Deploy Malware
- Novel OtterCookie malware added to Contagious Interview attack arsenal
- Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Threats related to North Korea-Linked Contagious Interview Actors (REF9403)
- North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials
- OTTERCOOKIE Malware Hidden in SVG Flag Images Backdoors Developers via Fake Coding Tests (Contagious Interview / REF9403)
- Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403)
Detection coverage for TL-2026-1452
As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1452 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.