The Hacker News17%
Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images 55%
By Ravie Lakshmanan10%
7/17/2026, 1:48:00 PM
BS Summary: This article contains 19 faulty reasoning types, including Biased Writer Voice, Overconfidence Bias, and Hasty Generalization, with Ambiguity (Equivocation) as the most egregious example at 16.1% saturation with 98 hits. Analysis detected 915 faulty-reasoning hits from 609 analyzed words, generating a BS Score of 53% and a BS Rank of 55% (8,169 of 17,854 articles). This article is worse (more manipulative) than 54.20% of the article peer group.
North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges.
"Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based remote access trojan (RAT), and a clipboard stealer," Elastic Security Labs said in a report shared with The Hacker News.
The findings once again highlight the continued targeting of software developers by state-sponsored hackers aligned with the Democratic People's Republic of Korea (DPRK) with an aim to steal sensitive data and plunder cryptocurrency wallets.
The activity is being tracked under the moniker REF9403.
The cybersecurity arm of the Dutch enterprise search and observability platform said it discovered the campaign after the threat actors targeted members of its community Slack workspace with social engineering lures for purported job offers, highlighting a new initial access avenue not previously documented in attacks associated with Contagious Interview, a sophisticated social engineering operation ongoing since at least December 2022.
The messages, posted by a user named Maxwell on the #jobs Slack channel in late May 2026, sought an experienced developer to help with upgrading their e-commerce platform to a "modern, scalable architecture using Next.js (v14), NestJS, PostgreSQL, and Auth.js" along with Stripe integration.
Specifically, the repositories distributed as part of the scheme incorporate fully functional code but also embed malicious code in the form of SVG images to sidestep detection.
"While these legitimate-looking projects run perfectly fine, the malicious code is triggered silently behind-the-scenes," Elastic said.
"The payloads are split into base64 fragments inside HTML comments across every SVG flag image inside an assets directory.
These files appear to be normal images of country flags (AE.svg, AF.svg), but each file contains an injected comment block with Base64-encoded data."
The payload is then assembled together by a JavaScript file ("serverValidation.js") present in the repository.
The attack chain is engineered such that the malware is executed on each server boot.
Elastic said the main payload shares overlap with OtterCookie, a cross-platform malware that first emerged in September 2024.
OtterCookie "evolved from a basic tool for executing remote commands and searching for crypto keys into a modular program capable of broader data theft with a capability to check for VM environments, install communication clients like socket.io for C2, exfiltrate information, executes arbitrary shell commands, load other modules to collect specific intended data and reports results," Microsoft noted back in March.
The malware incorporates four distinct modules that allow it to harvest data from web browsers and cryptocurrency wallets, collect files matching a specific list of extensions, facilitate persistent remote control using a Socket.IO-based trojan that can execute shell commands, capture clipboard content, and drop Windows executables.
Among the files gathered by OtterCookie include artificial intelligence (AI) coding tooling extensions such as .claude, .cursor, .gemini, .windsurf, .pearai, and .llama, suggesting the threat actor is actively refining its arsenal to hoover as much information as possible.
It's worth noting that the malware also exhibits some functional overlaps with a data stealer and trojan distributed via bogus npm packages masquerading as Rollup polyfill tooling, suggesting the threat actors are pursuing multiple vectors for propagation.
"This campaign reinforces that developers remain a prime target, where the compromise of a single individual can provide the initial access needed to enable far-reaching supply chain attacks against downstream organizations," Elastic said.
"The success of these operations underscores how compromising an individual developer can provide a path to much broader organizational impact."
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.