Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors associated with the Contagious Interview campaign (REF9403) are leveraging social engineering to compromise software developers and subsequently launch supply chain attacks. The campaign utilizes fake job postings and coding challenges to entice victims into executing trojanized repositories. These repositories contain SVG images that employ steganography to conceal malicious code within seemingly legitimate project files.

Specifically, the attack chain involves distributing repositories containing SVG images with embedded Base64-encoded data. This data is assembled by a JavaScript file, "serverValidation.js," triggering a multi-stage payload – OtterCookie – upon execution. OtterCookie is a cross-platform malware that has evolved from a basic remote command execution tool to a more sophisticated program capable of broader data theft, including cryptocurrency wallet harvesting and VM detection.

OtterCookie incorporates four distinct modules: a browser credential stealer, a file stealer, a Socket.IO-based remote access trojan, and a clipboard stealer. The malware also collects files with specific extensions and can execute arbitrary shell commands. The campaign’s success hinges on compromising individual developers, providing a pathway to wider organizational impact through supply chain attacks.

This tactic demonstrates a continued focus on developers as a prime target, emphasizing the potential for significant damage when a single compromised individual can provide access to a wider network of downstream organizations. The campaign’s use of multiple vectors, including bogus npm packages masquerading as Rollup polyfill tooling, further highlights the sophistication of the threat actors.