North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials — Threadlinqs Intelligence
As of 2026-07-20, North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials is a high-severity malware threat attributed to Contagious Interview (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-1571 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Contagious Interview · North Korea · FINANCIAL
DPRK-aligned threat actors tracked as Contagious Interview (campaign REF9403) are impersonating recruiters running fake coding-interview assessments to lure software developers into executing
Elastic Security Labs (researcher Daniel Stepanic) disclosed on 2026-07-17 a new delivery technique used by the DPRK-aligned Contagious Interview cluster (tracked internally as REF9403), part of the long-running 'Contagious Interview'/'DeceptiveDevelopment' ecosystem that has used fake job interviews to target software developers since at least November 2023. In the newly documented wave, a threat actor persona named 'Maxwell' posted in Elastic's community Slack #jobs channel around 2026-05-26 soliciting an experienced developer for an e-commerce platform upgrade. Interested candidates were moved to direct messages and instructed to complete a coding assessment by cloning a trojanized fork of the legitimate Next.js GoCart e-commerce template (originally from GreatStackDev), distributed as ZIP archives such as next-ecommerce-private-main.zip, ecommerce-platform-main.zip, shopping-platform-main.zip, and shop-main.zip.
The core innovation is SVG-based steganography: the malicious JavaScript payload is split into Base64-encoded fragments embedded inside HTML comments across a set of SVG flag-icon assets (AE.svg, AF.svg, and other country-code flags) placed in the project's assets directory. A file named serverValidation.js, triggered on server boot / npm install, reads every SVG flag file in alphabetical order, extracts the embedded Base64 comment fragments, concatenates them, decodes the result via a custom Check() function, and executes it with eval() — a technique designed to defeat static string-matching and signature-based detection since no single file contains the complete malicious payload.
Once reconstructed and executed, the payload deploys a four-stage, cross-platform (Windows/macOS/Linux) capability set aligned with the OtterCookie malware family (js.otter_cookie), which itself evolved from the BeaverTail (first-stage stealer/downloader) and InvisibleFerret (RAT) lineage — the boundaries between these families have blurred as DPRK operators converge toward a single all-in-one implant:
Stage 1 — Browser Credential & Crypto Wallet Stealer: masquerades its process as 'npm-cache'; harvests saved browser credentials and autofill data; targets roughly 25 cryptocurrency wallet browser-extension databases (MetaMask, Phantom, Keplr, UniSat, and others); exfiltrates the macOS System Keychain.
Stage 2 — File Stealer: performs recursive filesystem sweeps for developer secrets — .env* files, .doc/.docx, .pdf, .pem, SSH keys (.ssh), and cloud credential directories (.aws, .azure); enumerates logical drives on Windows via `wmic logicaldisk get name`; notably excludes AI coding-assistant configuration directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) from its own targeting, an operational-security choice to avoid disturbing tooling the operators may themselves rely on or to reduce noisy detections.
Stage 3 — Socket.IO-based Remote Access Trojan: establishes a persistent HTTPS Socket.IO command-and-control channel; enforces single-instance execution using a PID lock file; performs VM/sandbox detection across Windows, macOS, and Linux; provides an interactive remote shell via child_process.exec() for arbitrary command execution.
Stage 4 — Clipboard Stealer & Windows Second-Stage Dropper: polls the system clipboard every 500ms on Windows and macOS (commonly used to hijack copied cryptocurrency wallet addresses); on Windows, downloads three additional binaries disguised with .txt extensions and later renamed to executables — hostService.txt to hostService.exe, printSvc.txt to printSvc.exe, and dhcpSvc.txt to dhcpSvc.exe.
The JavaScript payload is protected with obfuscator.io, using string-array extraction with index-based lookups, a self-rotating array for anti-tampering, and infinite while(!![]) loop obfuscation patterns to hinder analysis. At time of discovery the trojanized repositories reportedly triggered zero antivirus detections.
Command-and-control infrastructure centers on the domain rightwidth[.]dev and
Weaknesses (CWE)
CWE-506, CWE-912, CWE-494
Target sectors: technology, softwaredevelopment, cryptocurrency, web3, fintech
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1585, T1586.001, T1587.001, T1583.001, T1566, T1566.003, T1195.002, T1199, T1204.002, T1059.007
