North Korean hackers hide malware in SVG flags of fake coding tests

Researchers have observed a new wave of attacks under the Contagious Interview campaign, which has been linked to North Korean hacking groups. The threat actors distribute fake job openings and coding test assignments with malicious code hidden inside them.

Steganography in flag images

What sets the campaign apart is its use of steganography in SVG files. The malicious payload is disguised inside flag images that, at first glance, raise no suspicion with the victim.

The victims are developers who respond to bogus job openings and complete the “test assignments” they are given. Running such a project on one's own computer leads to infection.

A four-stage payload

According to the researchers, any user who runs the infected project receives a four-stage malicious payload associated with the OTTERCOOKIE family. It comprises:

• a module for stealing browser credentials and cryptocurrency wallet data;
• a file stealer;
• additional payload components that ensure further persistence in the system.

This approach lets the attackers progressively expand their access to the victim's data — from accounts and crypto assets to arbitrary files on the device.

Campaign context

Contagious Interview is a well-known campaign in which North Korean hackers, posing as recruiters and employers, draw developers into an “interview” process that involves completing technical assignments. The use of steganography in SVG files points to the attackers' intent to make it harder for security tools and antivirus solutions to detect the malicious code.

Developers responding to job offers from unverified sources are advised to be cautious about running third-party projects and test assignments, especially if they require installing additional dependencies or contain unusual image files.

Source: The Hacker News