OTTERCOOKIE Malware Hidden in SVG Flag Images Backdoors Developers via Fake Coding Tests (Contagious Interview / REF9403) — Threadlinqs Intelligence
As of 2026-07-20, OTTERCOOKIE Malware Hidden in SVG Flag Images Backdoors Developers via Fake Coding Tests (Contagious Interview / REF9403) is a high-severity malware threat attributed to Contagious Interview (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1581 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Contagious Interview · North Korea · FINANCIAL
DPRK-aligned Contagious Interview actors (tracked as REF9403) are luring software developers via fake job-interview coding tests on Slack, delivering a trojanized e-commerce project that hides an
Elastic Security Labs identified a new wave of the long-running Contagious Interview operation, tracked under the cluster REF9403, after DPRK-aligned operators targeted Elastic's own community Slack workspace. An actor posing as a recruiter named 'Maxwell' posted in the #jobs channel on May 26, 2026, offering short-term e-commerce platform developer work and directing respondents to complete a 'coding assessment' by cloning and running a fully functional Next.js e-commerce repository (variously packaged as next-ecommerce-private-main.zip, shopping-platform-main.zip, ecommerce-platform.zip, ecommerce-platform-main.zip, shopping-platform.rar, shop-main.zip, and ecommerce-main.zip).
The repository is legitimate and runnable, which is precisely what makes the trojanization difficult to spot: hidden inside the project's assets/flags/ directory are ordinary-looking SVG country-flag images (e.g. AE.svg, AF.svg) that carry Base64-encoded fragments of the malicious payload embedded inside HTML comment blocks. A file named serverValidation.js, invoked from server/index.js via a runServerValidation() call, reads every SVG in the flags directory, concatenates the fragments in alphabetical filename order, Base64-decodes them with a custom Check() decoder (built specifically to dodge signature-based detection of standard Buffer/atob usage), and executes the reconstructed JavaScript via eval(). Because the trigger fires automatically whenever the developer runs npm run dev or npm start to test the coding assignment, the backdoor activates transparently during normal, expected project use. At time of Elastic's publication (July 18, 2026), none of the trojanized repositories were flagged by any antivirus engine.
The reconstructed payload is a four-stage, all-in-one package that Elastic assesses is closely aligned with the OTTERCOOKIE malware family first documented by NTT Security in December 2024, sharing matching strings, behavioral patterns, and infrastructure conventions. Unlike earlier Contagious Interview activity, which relied on a distinct first-stage BEAVERTAIL downloader handing off to a separate Python-based OTTERCOOKIE/InvisibleFerret stage, this sample consolidates all functionality into a single obfuscated JavaScript payload (protected with obfuscator.io string-array extraction and self-rotating array / while(!![]) control-flow obfuscation), blurring the previously clear boundary between BEAVERTAIL and OTTERCOOKIE.
Stage 1 is a cross-platform browser credential and cryptocurrency wallet stealer. It enumerates Chrome, Edge, Brave, Opera, and LT Browser profile directories (%LOCALAPPDATA% on Windows, ~/Library/Application Support/ on macOS, ~/.config/ on Linux), harvests the 'Login Data' and 'Web Data' SQLite stores plus the macOS system keychain (~/Library/Keychains/login.keychain-db), and targets Local Extension Settings LevelDB databases for 25 cryptocurrency wallet extensions including MetaMask, Phantom, Rabby, Keplr, UniSat, Trust Wallet, TronLink, Solflare, Tonkeeper, Sui Wallet, Binance Wallet, Coin98, Crypto.com DeFi Wallet, Kaia Wallet, Ready, OKX Wallet, Core, Exodus, TON Wallet, OpenMask, SafePal, My TON Wallet, Atomic Wallet, and MathWallet. The eight highest-priority wallets receive a retry-on-failure exfiltration path via the /cldbs endpoint; the remainder use fire-and-forget POSTs. The process masquerades under the title 'npm-cache' to blend into normal Node.js process listings, and performs VM/sandbox detection (WMIC queries for vmware/virtualbox/qemu/'microsoft corporation' on Windows, system_profiler keyword scans on macOS, /proc/cpuinfo hypervisor checks on Linux) — detections are tagged '(VM)' in exfiltrated data but do not block execution, indicating the check is used for analyst triage rather than evasion.
Stage 2 is a file stealer performing recursive filesystem scans for developer-sensitive material: environment files (*.env*), documents (*.doc, *.docx, *.pdf, *.md, *.rtf, *.odt), spreadsheets (*.xls, *.
Weaknesses (CWE)
CWE-506, CWE-912, CWE-798
Target sectors: technology, software development, cryptocurrency, financial technology
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.002, T1059.007, T1204, T1546, T1027, T1001.002, T1140, T1036.005, T1497