# OTTERCOOKIE Malware Hidden in SVG Flag Images Backdoors Developers via Fake Coding Tests (Contagious Interview / REF9403)

> DPRK-aligned Contagious Interview actors (tracked as REF9403) are luring software developers via fake job-interview coding tests on Slack, delivering a trojanized e-commerce project that hides an OTTERCOOKIE-aligned four-stage payload as Base64 fragments inside SVG flag images. A companion serverValidation.js file reassembles and eval()s the payload on every server boot, deploying a browser/crypto-wallet stealer, file stealer, Socket.IO-based RAT, and clipboard stealer that evaded all antivirus detection at time of discovery.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1581
- **ID:** TL-2026-1581
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Elastic Security Labs identified a new wave of the long-running Contagious Interview operation, tracked under the cluster REF9403, after DPRK-aligned operators targeted Elastic's own community Slack workspace. An actor posing as a recruiter named 'Maxwell' posted in the #jobs channel on May 26, 2026, offering short-term e-commerce platform developer work and directing respondents to complete a 'coding assessment' by cloning and running a fully functional Next.js e-commerce repository (variously packaged as next-ecommerce-private-main.zip, shopping-platform-main.zip, ecommerce-platform.zip, ecommerce-platform-main.zip, shopping-platform.rar, shop-main.zip, and ecommerce-main.zip).

The repository is legitimate and runnable, which is precisely what makes the trojanization difficult to spot: hidden inside the project's assets/flags/ directory are ordinary-looking SVG country-flag images (e.g. AE.svg, AF.svg) that carry Base64-encoded fragments of the malicious payload embedded inside HTML comment blocks. A file named serverValidation.js, invoked from server/index.js via a runServerValidation() call, reads every SVG in the flags directory, concatenates the fragments in alphabetical filename order, Base64-decodes them with a custom Check() decoder (built specifically to dodge signature-based detection of standard Buffer/atob usage), and executes the reconstructed JavaScript via eval(). Because the trigger fires automatically whenever the developer runs npm run dev or npm start to test the coding assignment, the backdoor activates transparently during normal, expected project use. At time of Elastic's publication (July 18, 2026), none of the trojanized repositories were flagged by any antivirus engine.

The reconstructed payload is a four-stage, all-in-one package that Elastic assesses is closely aligned with the OTTERCOOKIE malware family first documented by NTT Security in December 2024, sharing matching strings, behavioral patterns, and infrastructure conventions. Unlike earlier Contagious Interview activity, which relied on a distinct first-stage BEAVERTAIL downloader handing off to a separate Python-based OTTERCOOKIE/InvisibleFerret stage, this sample consolidates all functionality into a single obfuscated JavaScript payload (protected with obfuscator.io string-array extraction and self-rotating array / while(!![]) control-flow obfuscation), blurring the previously clear boundary between BEAVERTAIL and OTTERCOOKIE.

Stage 1 is a cross-platform browser credential and cryptocurrency wallet stealer. It enumerates Chrome, Edge, Brave, Opera, and LT Browser profile directories (%LOCALAPPDATA% on Windows, ~/Library/Application Support/ on macOS, ~/.config/ on Linux), harvests the 'Login Data' and 'Web Data' SQLite stores plus the macOS system keychain (~/Library/Keychains/login.keychain-db), and targets Local Extension Settings LevelDB databases for 25 cryptocurrency wallet extensions including MetaMask, Phantom, Rabby, Keplr, UniSat, Trust Wallet, TronLink, Solflare, Tonkeeper, Sui Wallet, Binance Wallet, Coin98, Crypto.com DeFi Wallet, Kaia Wallet, Ready, OKX Wallet, Core, Exodus, TON Wallet, OpenMask, SafePal, My TON Wallet, Atomic Wallet, and MathWallet. The eight highest-priority wallets receive a retry-on-failure exfiltration path via the /cldbs endpoint; the remainder use fire-and-forget POSTs. The process masquerades under the title 'npm-cache' to blend into normal Node.js process listings, and performs VM/sandbox detection (WMIC queries for vmware/virtualbox/qemu/'microsoft corporation' on Windows, system_profiler keyword scans on macOS, /proc/cpuinfo hypervisor checks on Linux) — detections are tagged '(VM)' in exfiltrated data but do not block execution, indicating the check is used for analyst triage rather than evasion.

Stage 2 is a file stealer performing recursive filesystem scans for developer-sensitive material: environment files (*.env*), documents (*.doc, *.docx, *.pdf, *.md, *.rtf, *.odt), spreadsheets (*.xls, *.xlsx, *.csv), source and config files (*.ts, *.js, *.json, *.ini, *.pem, *.secret), images (*.png, *.jpg, *.jpeg, *.webp), and shell history (.bash_history, .zsh_history). It also unconditionally collects credential-relevant directories (.aws, .azure, .config, .ssh) regardless of extension. On Windows the stealer aggressively enumerates every mounted logical drive via wmic logicaldisk get name; on macOS/Linux it is scoped to the user home directory. Notably, the file stealer deliberately excludes AI coding-assistant artifact directories (.claude, .cursor, .gemini, .windsurf) and standard build/dependency noise (node_modules, vendor, cache), indicating deliberate operator tuning to avoid low-value or easily-flagged data. Matched files are uploaded to upload.rightwidth[.]dev via the /upload endpoint using a static axios/1.18.1 User-Agent.

Stage 3 is a persistent Socket.IO-based remote access trojan connecting to controller.rightwidth[.]dev. It registers with the C2 via POST to /api/service/process/<uid>, sends status/heartbeat logging to /api/service/makelog, and accepts arbitrary shell command execution through Socket.IO events that are run via Node's child_process.exec() with output returned over a 'message' event — giving the operator effectively interactive shell access to the compromised developer workstation. A PID lock file at C:\Users\[user]\.npm\vhost.ctl enforces single-instance execution on Windows.

Stage 4 combines a clipboard stealer that polls the system clipboard every 500ms (positioned to intercept copy-pasted cryptocurrency wallet addresses or seed phrases for on-the-fly substitution/theft) with a Windows-only secondary-payload dropper. The dropper retrieves additional binaries — observed as hostService.exe, printSvc.exe, and dhcpSvc.exe — from file.rightwidth[.]dev via curl, initially saving them with a .txt extension before renaming to .exe to slip past extension-based content filtering. These binaries were not recovered for analysis at publication time; their naming (masquerading as legitimate Windows services) suggests discovery/enumeration or further persistence functionality.

Infrastructure is centered on the rightwidth[.]dev domain and its subdomains (ldb.rightwidth[.]dev for the browser/wallet stealer, upload.rightwidth[.]dev for the file stealer, controller.rightwidth[.]dev for the Socket.IO RAT, file.rightwidth[.]dev for secondary binaries), backed by IPv4 hosts 195.26.248[.]212 and 188.40.64[.]61. The observed API endpoint patterns (/api/service/makelog, /api/service/process/<uid>, /cldbs, /upload) match infrastructure conventions previously linked to Contagious Interview by JFrog Security research, reinforcing the DPRK/Contagious Interview attribution. A BeaconBeagle correlation check against rightwidth.dev returned no existing C2 correlation records at time of this research, and a direct lookup against 195.26.248.212 returned no match — both domain and IP should be treated as newly-surfaced infrastructure for tracking purposes.

Contagious Interview (tracked by MITRE as group G1052) has run continuously since December 2022, using fabricated recruiter personas across GitHub, Slack, Discord, LinkedIn, and Telegram to socially engineer software developers into executing malicious 'coding assessment' or 'take-home project' repositories — a durable, high-yield initial access vector against a technically sophisticated victim population that would normally be resistant to conventional phishing. This activity sits alongside a broader pattern of DPRK-aligned developer-targeting supply-chain operations, including the UNC1069 compromise of an Axios npm package maintainer via Slack in April 2026, underscoring that the same operators are willing to pursue both direct social-engineering delivery and open-source supply-chain compromise against the same target population.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Spearphishing Link
- T1059.007 JavaScript
- T1204 User Execution
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1001.002 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1614 System Location Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1583.001 Domains
- T1588.001 Malware
- T1585.001 Social Media Accounts

## Sources

- [Contagious Interview malware in SVG images: DPRK campaign](https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography)
- [North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers](https://cybersecuritynews.com/north-korean-hackers-ottercookie-malware/)
- [Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images](https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html)
- [The Steganographic Trap: North Korean Hackers Weaponize Coding Tests to Deploy OtterCookie Malware](https://www.techvipul.com/2026/07/the-steganographic-trap-north-korean.html)
- [Malware Hidden in SVG Images: REF9403 Explained](https://meetcyber.net/malware-hidden-in-svg-images-ref9403-87e777606c69?gi=6ecbff8c64f9)
- [North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers](https://www.cryptika.com/north-korean-hackers-hide-ottercookie-malware-in-svg-images-to-backdoor-developers/)
- [North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections](https://www.techtimes.com/articles/320927/20260718/north-korea-buried-four-stage-malware-flag-images-zero-antivirus-detections.htm)
- [North Korean Contagious Interview Campaign Hides OTTERCOOKIE Malware in SVG Images](https://gbhackers.com/ottercookie-malware-in-svg-images/amp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1581