Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

In a sophisticated convergence of social engineering and technical obfuscation, North Korean state-sponsored threat actors have refined their tactics for targeting developers and cryptocurrency professionals. The latest campaign, an evolution of the notorious "Contagious Interview" operation, utilizes deceptive job recruitment schemes to trick software engineers into downloading malicious repositories. At the heart of this campaign is a clever use of steganography, where malicious code is embedded within Scalable Vector Graphics (SVG) files—specifically images of national flags—to bypass traditional security scans and deliver the "OtterCookie" malware family.

This development is rooted in a long-standing strategy by threat actors linked to the Democratic People's Republic of Korea (DPRK), likely falling under the umbrella of the Lazarus Group or its subsidiaries. For years, these actors have targeted the financial and tech sectors to generate illicit revenue for the regime. The "Contagious Interview" campaign represents a shift toward highly personalized lures, where hackers pose as recruiters from reputable firms on platforms like LinkedIn and Discord. They invite candidates to solve "coding challenges," which require the victim to clone a GitHub repository or run a local project that contains the hidden infectious components.

The technical mechanics of this specific exploit are particularly clever. By utilizing SVG files to hide payloads, the attackers leverage the text-based nature of the format. Unlike traditional raster images, SVGs are XML-based, making it easier to inject malicious scripts or encoded data that appear as harmless metadata to many antivirus solutions. Once the developer runs the "test" project, a multi-stage execution process begins. The SVG file acts as a hidden carrier; when processed, it de-obfuscates a JavaScript payload that eventually deploys OtterCookie. This malware is a specialized stealer designed to exfiltrate browser credentials, session cookies, and, most crucially, private keys from cryptocurrency wallet extensions.

The implications for the tech industry are severe. This campaign exploits the fundamental trust inherent in the open-source and remote-hiring ecosystems. Developers are accustomed to cloning repositories and running external code as part of their daily workflow and interview processes. By poisoning these routine tasks, the attackers have turned a standard professional interaction into a high-risk vulnerability. Furthermore, the use of steganography suggests that North Korean groups are becoming more adept at bypassing EDR (Endpoint Detection and Response) systems that typically flag executable files but may overlook image-based assets.

From a regulatory and corporate standpoint, this trend necessitates a paradigm shift in how companies handle recruitment and code verification. Organizations can no longer assume that a developer’s local machine is a safe sandbox. The theft of session cookies—a hallmark of OtterCookie—is especially dangerous as it allows attackers to bypass multi-factor authentication (MFA) by hijacking active sessions. For firms in the decentralized finance (DeFi) and blockchain sectors, the risk is existential, as a single compromised developer can lead to the draining of institutional hot wallets or the compromise of sensitive smart contract code.

Moving forward, the industry must watch for an increase in the complexity of these "Trojan Horse" repositories. We should expect to see attackers utilizing more diverse file formats and perhaps even leveraging AI to generate highly convincing, personalized interview dialogue to build rapport with targets over several days. Organizations should consider moving coding assessments to cloud-based, isolated environments to protect their employees' local systems. As North Korea continues to rely on cyber-heists to fund its state operations, the boundary between professional networking and national security will continue to blur, making technical vigilance a mandatory component of the modern job hunt.