Elastic Security Labs (researcher Daniel Stepanic) disclosed on 2026-07-17 a new delivery technique used by the DPRK-aligned Contagious Interview cluster (tracked internally as REF9403), part of the long-running 'Contagious Interview'/'DeceptiveDevelopment' ecosystem that has used fake job interviews to target software developers since at least November 2023. In the newly documented wave, a threat actor persona named 'Maxwell' posted in Elastic's community Slack #jobs channel around 2026-05-26 soliciting an experienced developer for an e-commerce platform upgrade. Interested candidates were moved to direct messages and instructed to complete a coding assessment by cloning a trojanized fork of the legitimate Next.js GoCart e-commerce template (originally from GreatStackDev), distributed as ZIP archives such as next-ecommerce-private-main.zip, ecommerce-platform-main.zip, shopping-platform-main.zip, and shop-main.zip.

The core innovation is SVG-based steganography: the malicious JavaScript payload is split into Base64-encoded fragments embedded inside HTML comments across a set of SVG flag-icon assets (AE.svg, AF.svg, and other country-code flags) placed in the project's assets directory. A file named serverValidation.js, triggered on server boot / npm install, reads every SVG flag file in alphabetical order, extracts the embedded Base64 comment fragments, concatenates them, decodes the result via a custom Check() function, and executes it with eval() — a technique designed to defeat static string-matching and signature-based detection since no single file contains the complete malicious payload.

Once reconstructed and executed, the payload deploys a four-stage, cross-platform (Windows/macOS/Linux) capability set aligned with the OtterCookie malware family (js.otter_cookie), which itself evolved from the BeaverTail (first-stage stealer/downloader) and InvisibleFerret (RAT) lineage — the boundaries between these families have blurred as DPRK operators converge toward a single all-in-one implant:

Stage 1 — Browser Credential & Crypto Wallet Stealer: masquerades its process as 'npm-cache'; harvests saved browser credentials and autofill data; targets roughly 25 cryptocurrency wallet browser-extension databases (MetaMask, Phantom, Keplr, UniSat, and others); exfiltrates the macOS System Keychain.

Stage 2 — File Stealer: performs recursive filesystem sweeps for developer secrets — .env* files, .doc/.docx, .pdf, .pem, SSH keys (.ssh), and cloud credential directories (.aws, .azure); enumerates logical drives on Windows via `wmic logicaldisk get name`; notably excludes AI coding-assistant configuration directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) from its own targeting, an operational-security choice to avoid disturbing tooling the operators may themselves rely on or to reduce noisy detections.

Stage 3 — Socket.IO-based Remote Access Trojan: establishes a persistent HTTPS Socket.IO command-and-control channel; enforces single-instance execution using a PID lock file; performs VM/sandbox detection across Windows, macOS, and Linux; provides an interactive remote shell via child_process.exec() for arbitrary command execution.

Stage 4 — Clipboard Stealer & Windows Second-Stage Dropper: polls the system clipboard every 500ms on Windows and macOS (commonly used to hijack copied cryptocurrency wallet addresses); on Windows, downloads three additional binaries disguised with .txt extensions and later renamed to executables — hostService.txt to hostService.exe, printSvc.txt to printSvc.exe, and dhcpSvc.txt to dhcpSvc.exe.

The JavaScript payload is protected with obfuscator.io, using string-array extraction with index-based lookups, a self-rotating array for anti-tampering, and infinite while(!![]) loop obfuscation patterns to hinder analysis. At time of discovery the trojanized repositories reportedly triggered zero antivirus detections.

Command-and-control infrastructure centers on the domain rightwidth[.]dev and subdomains: ldb.rightwidth[.]dev (browser/wallet stealer C2), upload.rightwidth[.]dev (file stealer upload endpoint), controller.rightwidth[.]dev (Socket.IO RAT C2), and file.rightwidth[.]dev (Windows second-stage binary download), backed by IP addresses 195.26.248[.]212 and 188.40.64[.]61. Known C2 API endpoints include /api/service/makelog (logging channel), /api/service/process/<uid> (registration beacon), /cldbs (cryptocurrency wallet exfiltration), and /upload (file/credential uploads).

The same DPRK operator ecosystem has in parallel run a large-scale npm supply-chain sub-campaign: Socket researchers documented 197 newly identified malicious npm packages (31,000+ combined downloads) distributing OtterCookie-aligned payloads, including typosquatted/decoy packages such as tailwind-magic, tailwind-node, node-tailwind, node-tailwind-magic, and react-modal-select, alongside lure repositories like a cloned 'dexproject' impersonating the Knightsbridge DEX and a typosquat of tailwind-merge. Delivery infrastructure for this sub-campaign includes a Vercel-hosted staging site (tetrismic[.]vercel[.]app) serving second-stage JavaScript via postinstall scripts, a now-removed GitHub account 'stardev0914' that hosted 18 malicious repositories, and abuse of third-party JSON-hosting services (JSON Keeper, JSONsilo, npoint.io) to store and relay payloads — reflecting a factory-style operational model treating npm, GitHub, and Vercel as a combined, renewable initial-access channel. Prior related waves (reported by JFrog and others) used bogus Rollup-polyfill-impersonating npm packages and are attributed to the same cluster; researchers note overlapping API endpoint patterns and infrastructure with previously reported JFrog findings and behavioral alignment with Microsoft's March 2026 DPRK reporting, as well as separately-tracked activity (UNC1069) that compromised the Axios npm package via Slack-based social engineering.

Targeting is centered on individual software developers and Web3/crypto engineers reached through developer communities (Slack, LinkedIn, GitHub, npm) rather than direct enterprise infrastructure — a deliberate strategy to gain initial access to organizations indirectly through compromised developer endpoints, credentials, and source-code access, consistent with DPRK's dual espionage/revenue-generation motivations (cryptocurrency theft funds weapons programs) documented across the broader Contagious Interview / DeceptiveDevelopment ecosystem since 2023.