# North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials

> DPRK-aligned threat actors tracked as Contagious Interview (campaign REF9403) are impersonating recruiters running fake coding-interview assessments to lure software developers into executing trojanized Next.js e-commerce repositories. The malicious payload is fragmented into Base64 chunks hidden in HTML comments inside SVG flag-icon images and reassembled at runtime, ultimately deploying a four-stage OtterCookie-aligned infostealer/RAT that harvests browser credentials, crypto wallets, files, and clipboard data over a Socket.IO C2 channel.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1571
- **ID:** TL-2026-1571
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Elastic Security Labs (researcher Daniel Stepanic) disclosed on 2026-07-17 a new delivery technique used by the DPRK-aligned Contagious Interview cluster (tracked internally as REF9403), part of the long-running 'Contagious Interview'/'DeceptiveDevelopment' ecosystem that has used fake job interviews to target software developers since at least November 2023. In the newly documented wave, a threat actor persona named 'Maxwell' posted in Elastic's community Slack #jobs channel around 2026-05-26 soliciting an experienced developer for an e-commerce platform upgrade. Interested candidates were moved to direct messages and instructed to complete a coding assessment by cloning a trojanized fork of the legitimate Next.js GoCart e-commerce template (originally from GreatStackDev), distributed as ZIP archives such as next-ecommerce-private-main.zip, ecommerce-platform-main.zip, shopping-platform-main.zip, and shop-main.zip.

The core innovation is SVG-based steganography: the malicious JavaScript payload is split into Base64-encoded fragments embedded inside HTML comments across a set of SVG flag-icon assets (AE.svg, AF.svg, and other country-code flags) placed in the project's assets directory. A file named serverValidation.js, triggered on server boot / npm install, reads every SVG flag file in alphabetical order, extracts the embedded Base64 comment fragments, concatenates them, decodes the result via a custom Check() function, and executes it with eval() — a technique designed to defeat static string-matching and signature-based detection since no single file contains the complete malicious payload.

Once reconstructed and executed, the payload deploys a four-stage, cross-platform (Windows/macOS/Linux) capability set aligned with the OtterCookie malware family (js.otter_cookie), which itself evolved from the BeaverTail (first-stage stealer/downloader) and InvisibleFerret (RAT) lineage — the boundaries between these families have blurred as DPRK operators converge toward a single all-in-one implant:

Stage 1 — Browser Credential & Crypto Wallet Stealer: masquerades its process as 'npm-cache'; harvests saved browser credentials and autofill data; targets roughly 25 cryptocurrency wallet browser-extension databases (MetaMask, Phantom, Keplr, UniSat, and others); exfiltrates the macOS System Keychain.

Stage 2 — File Stealer: performs recursive filesystem sweeps for developer secrets — .env* files, .doc/.docx, .pdf, .pem, SSH keys (.ssh), and cloud credential directories (.aws, .azure); enumerates logical drives on Windows via `wmic logicaldisk get name`; notably excludes AI coding-assistant configuration directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) from its own targeting, an operational-security choice to avoid disturbing tooling the operators may themselves rely on or to reduce noisy detections.

Stage 3 — Socket.IO-based Remote Access Trojan: establishes a persistent HTTPS Socket.IO command-and-control channel; enforces single-instance execution using a PID lock file; performs VM/sandbox detection across Windows, macOS, and Linux; provides an interactive remote shell via child_process.exec() for arbitrary command execution.

Stage 4 — Clipboard Stealer & Windows Second-Stage Dropper: polls the system clipboard every 500ms on Windows and macOS (commonly used to hijack copied cryptocurrency wallet addresses); on Windows, downloads three additional binaries disguised with .txt extensions and later renamed to executables — hostService.txt to hostService.exe, printSvc.txt to printSvc.exe, and dhcpSvc.txt to dhcpSvc.exe.

The JavaScript payload is protected with obfuscator.io, using string-array extraction with index-based lookups, a self-rotating array for anti-tampering, and infinite while(!![]) loop obfuscation patterns to hinder analysis. At time of discovery the trojanized repositories reportedly triggered zero antivirus detections.

Command-and-control infrastructure centers on the domain rightwidth[.]dev and subdomains: ldb.rightwidth[.]dev (browser/wallet stealer C2), upload.rightwidth[.]dev (file stealer upload endpoint), controller.rightwidth[.]dev (Socket.IO RAT C2), and file.rightwidth[.]dev (Windows second-stage binary download), backed by IP addresses 195.26.248[.]212 and 188.40.64[.]61. Known C2 API endpoints include /api/service/makelog (logging channel), /api/service/process/<uid> (registration beacon), /cldbs (cryptocurrency wallet exfiltration), and /upload (file/credential uploads).

The same DPRK operator ecosystem has in parallel run a large-scale npm supply-chain sub-campaign: Socket researchers documented 197 newly identified malicious npm packages (31,000+ combined downloads) distributing OtterCookie-aligned payloads, including typosquatted/decoy packages such as tailwind-magic, tailwind-node, node-tailwind, node-tailwind-magic, and react-modal-select, alongside lure repositories like a cloned 'dexproject' impersonating the Knightsbridge DEX and a typosquat of tailwind-merge. Delivery infrastructure for this sub-campaign includes a Vercel-hosted staging site (tetrismic[.]vercel[.]app) serving second-stage JavaScript via postinstall scripts, a now-removed GitHub account 'stardev0914' that hosted 18 malicious repositories, and abuse of third-party JSON-hosting services (JSON Keeper, JSONsilo, npoint.io) to store and relay payloads — reflecting a factory-style operational model treating npm, GitHub, and Vercel as a combined, renewable initial-access channel. Prior related waves (reported by JFrog and others) used bogus Rollup-polyfill-impersonating npm packages and are attributed to the same cluster; researchers note overlapping API endpoint patterns and infrastructure with previously reported JFrog findings and behavioral alignment with Microsoft's March 2026 DPRK reporting, as well as separately-tracked activity (UNC1069) that compromised the Axios npm package via Slack-based social engineering.

Targeting is centered on individual software developers and Web3/crypto engineers reached through developer communities (Slack, LinkedIn, GitHub, npm) rather than direct enterprise infrastructure — a deliberate strategy to gain initial access to organizations indirectly through compromised developer endpoints, credentials, and source-code access, consistent with DPRK's dual espionage/revenue-generation motivations (cryptocurrency theft funds weapons programs) documented across the broader Contagious Interview / DeceptiveDevelopment ecosystem since 2023.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1586.001 Social Media Accounts
- T1587.001 Malware
- T1583.001 Domains
- T1566 Phishing
- T1566.003 Spearphishing via Service
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1027.010 Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1497.001 System Checks
- T1033 System Owner/User Discovery
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1056.001 Keylogging
- T1005 Data from Local System
- T1115 Clipboard Data
- T1113 Screen Capture
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Contagious Interview: Malware Hidden in SVG Steganography](https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography)
- [New North Korean campaign uses fake coding interviews to steal developer credentials](https://malpedia.caad.fkie.fraunhofer.de/library/40546b50-1a62-4e60-9945-80d9ccb60212/)
- [North Korean Contagious Interview Campaign Hides OTTERCOOKIE Malware in SVG Images](https://gbhackers.com/ottercookie-malware-in-svg-images/amp/)
- [North Korean Hackers Abuse npm, GitHub, and Vercel to Spread OtterCookie Malware](https://gbhackers.com/ottercookie-malware/)
- [Contagious Interview campaign expands with 197 npm packages spreading new OtterCookie malware](https://securityaffairs.com/185170/apt/contagious-interview-campaign-expands-with-197-npm-ppackages-spreading-new-ottercookie-malware.html)
- [Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images](https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html)
- [Unmasking OtterCookie Malware in the Contagious Interview Campaign](https://hivepro.com/threat-advisory/unmasking-ottercookie-malware-in-the-contagious-interview-campaign/)
- [North Korea's Contagious Interview Malware Floods npm With 200 New Packages](https://securitybuzz.com/cybersecurity-news/north-koreas-contagious-interview-malware-floods-npm-with-200-new-packages/)
- [The Steganographic Trap: North Korean Hackers Weaponize Coding Tests to Deploy OtterCookie Malware](https://www.techvipul.com/2026/07/the-steganographic-trap-north-korean.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1571