# North Korea-Linked Contagious Interview Actors (REF9403) Hide OtterCookie-Aligned Malware in SVG Flag Images

> North Korean threat actors tracked as REF9403, part of the Contagious Interview / DeceptiveDevelopment campaign, distribute fake coding-test job assignments via Slack #jobs channels containing trojanized repositories that conceal a four-stage OtterCookie-aligned payload using base64-encoded code hidden in HTML comments within SVG flag images (e.g. AE.svg, AF.svg). The malware steals browser credentials, crypto wallet data, and files (including AI coding tool configs for .claude, .cursor, .gemini, .windsurf, .pearai, .llama), and establishes a Socket.IO-based RAT for persistent remote access.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1452
- **ID:** TL-2026-1452
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** REF9403 (North Korea)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

REF9403 is a North Korea-aligned cluster operating within the broader Contagious Interview (also tracked as DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121, CL-STA-0240, MITRE ATT&CK Group G1052) supply-chain social-engineering campaign, active since at least November 2023 and assessed by ESET (November 2024) to overlap with Lazarus Group cryptocurrency-theft operations. In this iteration, operators posted recruitment lures — using the persona "Maxwell" observed in late May 2026 in the Elastic Security community Slack workspace — advertising e-commerce platform upgrade contract work requiring Next.js, NestJS, PostgreSQL, Auth.js, and Stripe integration skills. Victims expressing interest are directed to a trojanized GitHub/GitLab/Bitbucket repository that appears to be a legitimate coding assignment.

The novel tradecraft in this wave is steganographic payload concealment inside SVG country-flag image assets (e.g. AE.svg, AF.svg) shipped as normal-looking UI assets within the fake project. Base64-encoded JavaScript fragments are hidden inside HTML comments in these SVG files; a companion script, serverValidation.js, reassembles the fragments into a working payload at runtime. Because the surrounding project code executes normally, the technique is designed to survive casual code review, and the malware re-triggers on every server/dev-environment boot, giving durable execution without an explicit persistence artifact in most cases.

The reassembled payload aligns with OtterCookie, a JavaScript-based, cross-platform (Windows/Linux/macOS) infostealer-RAT that emerged in September 2024 and has been iteratively hardened by the operators (Microsoft documented a heavily obfuscated October 2025 variant using encoded index lookups and shuffled arrays to defeat static/signature analysis). The four observed payload stages are: (1) a browser-credential and cryptocurrency-wallet stealer targeting Chrome/Brave stores and wallet mnemonic/private-key artifacts; (2) a file stealer that specifically enumerates and exfiltrates AI coding-assistant configuration directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) alongside classic credential stores (KeePass, 1Password, SSH/GPG keys, .env files); (3) a Socket.IO-based remote access trojan that registers the infected host with a C2 endpoint, performs VM/sandbox detection, fingerprints the host (hostname, network identifiers, OS, public IP), and executes arbitrary shell commands tasked by the operator; and (4) a clipboard-monitoring/screenshot module (leveraging benign-looking auxiliary npm packages such as node-global-key-listener and screenshot-desktop) for ambient surveillance and credential capture.

The campaign's infrastructure model chains GitHub-hosted trojanized repos to Vercel-hosted staging pages (previously observed: tetrismic.vercel.app) for payload delivery, with URL-shortening services (short.gy) used to obscure links, before handing off to attacker C2 for tasking and exfiltration via axios-based multipart form-data uploads. Related npm-based waves of the same operator infrastructure (Socket, reported concurrently) added 197 new malicious/typosquatted packages (e.g. tailwind-magic, node-tailwind, node-tailwind-magic, react-modal-select) impersonating tailwind-merge and accumulating over 31,000 downloads, published from the GitHub account stardev0914 (18 repositories) — illustrating the same actor set's parallel supply-chain-poisoning line of effort alongside the direct-interview-lure vector used against this specific target set.

The explicit targeting of AI coding-tool configuration directories is a novel objective for this cluster: harvesting .claude/.cursor/.gemini/.windsurf/.pearai/.llama config and credential material gives the operators access to API keys, MCP/tool tokens, and workspace context that can be pivoted into further supply-chain compromise of downstream projects the victim works on — consistent with REF9403's overarching goal of using compromised individual developers as a foothold into their employers' build/CI pipelines and codebases.

No CVE is associated with this activity; it is a social-engineering and supply-chain delivery chain rather than a vulnerability exploit. Motivation is assessed as primarily financial (cryptocurrency and credential theft funding the DPRK regime) with a secondary espionage/access-broker dimension via harvested developer secrets (cloud/API tokens, signing keys) that enable further downstream compromise.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1683 Generate Content
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1480 Execution Guardrails
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1115 Clipboard Data
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1090 Proxy
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft

## Sources

- [Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images](https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [Contagious Interview campaign expands with 197 npm packages spreading new OtterCookie malware](https://securityaffairs.com/185170/apt/contagious-interview-campaign-expands-with-197-npm-ppackages-spreading-new-ottercookie-malware.html)
- [Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121 (G1052)](https://attack.mitre.org/groups/G1052/)
- [North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign](https://thehackernews.com/2024/12/north-korean-hackers-deploy-ottercookie.html)
- [North Korea actors use OtterCookie malware in Contagious Interview campaign](https://securityaffairs.com/172382/malware/north-korea-linked-actors-using-ottercookie-backdoor.html)
- [Contagious Interview: Tracking the VS Code Tasks Vector](https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector)
- [Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery](https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/)
- [North Korean Hackers Target Freelance Developers in Job Scam to Deploy Malware](https://thehackernews.com/2025/02/north-korean-hackers-target-freelance.html)
- [Novel OtterCookie malware added to Contagious Interview attack arsenal](https://www.scworld.com/brief/novel-ottercookie-malware-added-to-contagious-interview-attack-arsenal)
- [Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1452