# North Korean Threat Actors Weaponize Fake Coding Tests with Steganography to Deploy OtterCookie Malware


Cybersecurity researchers have uncovered a sophisticated campaign in which North Korean threat actors are using counterfeit job postings and fake coding challenges to distribute a four-stage malware payload through steganographic techniques embedded in SVG image files. The attack, attributed to the *Contagious Interview* campaign, represents an escalation in social engineering tactics designed to target software developers and engineers—a high-value demographic offering access to secure systems and sensitive credentials.


## The Threat


The primary malware payload deployed in this campaign is OtterCookie, a modular credential and data theft tool that combines multiple stealing capabilities in a single infection chain. According to security researchers tracking the activity, the four-stage deployment works as follows:


1. Initial delivery: Victims are lured to fake job application platforms or GitHub-like repositories featuring legitimate-looking coding challenges

2. SVG-based steganography: Malicious code is embedded within SVG (Scalable Vector Graphics) image files—a technique that evades traditional endpoint detection

3. Multi-stage execution: The payload executes in stages, with each phase delivering additional capabilities

4. Credential and data exfiltration: OtterCookie targets browser credentials, cryptocurrency wallet authentication, and sensitive files stored on infected systems


The use of steganography in SVG files is particularly noteworthy because it allows threat actors to bypass file-scanning technologies that may flag executable binaries or suspicious scripts, while maintaining the appearance of benign image content. Any developer who downloaded and ran the malicious project ended up with a fully compromised system.


## Background and Context: The Contagious Interview Campaign


The *Contagious Interview* campaign has been tracking North Korean-aligned threat actors for the past several years, though this latest iteration marks a significant tactical refinement. The campaign's modus operandi involves creating convincingly fraudulent recruitment scenarios to gain trust with target victims.


Tactics employed include:


  • Counterfeit job postings on legitimate job boards and LinkedIn profiles impersonating real tech companies
  • GitHub repositories mimicking open-source projects or legitimate engineering challenges
  • Personalized outreach from fake recruiters with fabricated professional backgrounds
  • Coding challenges that appear to be standard industry screening tests
  • Time pressure and urgency ("We need to move quickly with our hiring process")

    • North Korean threat actors have long prioritized targeting software developers and engineers, particularly those working in cryptocurrency, finance, defense, and technology sectors. These individuals typically have:


  • Access to high-security systems and networks
  • Knowledge of security practices and vulnerabilities
  • Control over deployment pipelines and infrastructure
  • Cryptocurrency holdings or access to financial systems

    • The pivot to SVG-based steganography suggests that North Korean operators have observed deficiencies in standard endpoint detection systems and are actively adapting their techniques accordingly.


    ## Technical Details: Steganography and Multi-Stage Execution


    SVG Steganography Method


    SVG files are XML-based vector graphics that can contain embedded scripts, metadata, and styling information. Threat actors have discovered that they can hide malicious code within:


  • SVG script tags (<script> elements embedded in the file)
  • Event handlers on graphical elements (onload, onerror, onclick)
  • Data URIs and encoded payloads in presentation attributes
  • XML comments and unused metadata

    • Unlike binary executables, SVG files are often treated as low-risk by security scanning tools. When a developer opens an SVG file in a browser, downloads it from a project repository, or processes it with common graphics tools, the embedded script may execute with minimal scrutiny.


    Four-Stage Payload Architecture


    | Stage | Function | Delivery Mechanism |

    |-------|----------|-------------------|

    | Stage 1 | SVG steganography + script execution | Downloaded image file |

    | Stage 2 | Environment reconnaissance + credential enumeration | In-memory injection |

    | Stage 3 | Multi-purpose stealer (browser data, wallets, files) | OtterCookie module loader |

    | Stage 4 | Command & control communication + lateral movement | Encrypted C2 channel |


    The multi-stage design provides operational flexibility: each stage only downloads subsequent payloads if the environment appears safe, helping the campaign evade detection in sandboxed environments or security research labs.


    Browser Credential Stealing


    OtterCookie specifically targets:

  • Stored passwords in Chrome, Firefox, Edge, and Safari
  • Session tokens and authentication cookies
  • Saved payment methods and autofill data
  • OAuth tokens and API credentials

    • Cryptocurrency Wallet Extraction


    The malware searches for and exfiltrates:

  • Seed phrases and private keys from MetaMask, Ledger, and Trezor extensions
  • Wallet application configuration files
  • Exchange API keys and authentication credentials

    • File Stealer Capabilities


    OtterCookie recursively searches the infected system for:

  • Documents and spreadsheets (PDF, XLSX, DOCX)
  • Source code and configuration files
  • SSH private keys and authentication material
  • Database credentials and connection strings

    • ## Implications for Developers and Organizations


    Individual Risk


    Developers are uniquely vulnerable to this attack because they:

  • Regularly download and execute third-party code
  • Store high-value credentials and authentication tokens locally
  • Often work with cryptocurrency or financial systems
  • May be less suspicious of technical recruiting outreach

    • Organizational Impact


    Organizations face cascading risks if a developer's system is compromised:

  • Supply chain infiltration: Compromised build pipelines can inject malicious code into software released to thousands of customers
  • Lateral movement: Developer credentials can be used to access VPNs, repositories, and internal systems
  • IP theft: Source code, product roadmaps, and unreleased features may be exfiltrated
  • Regulatory exposure: Data breaches stemming from compromised developer systems trigger notification requirements and potential fines

    • Industry-Specific Concerns


    The targeting of developers in cryptocurrency and fintech sectors suggests that North Korean threat actors are prioritizing economic gain through direct theft or supply chain compromise. Financial services companies face particular exposure.


    ## Recommendations


    For Individual Developers:


  • Verify job opportunities independently: Contact companies directly using verified phone numbers or email addresses, not contact information provided by recruiters
  • Be skeptical of test projects: Legitimate companies rarely ask candidates to download and run complex code as part of initial screening
  • Isolate test environments: Use virtual machines or sandbox environments when executing unknown code
  • Secure credentials: Use password managers with unique passwords per site; enable MFA on cryptocurrency exchanges and email
  • Monitor accounts: Regularly review bank, exchange, and credit card statements for unauthorized activity

    • For Security Teams:


  • Endpoint detection: Deploy behavioral monitoring to detect credential access and file exfiltration; create detection rules for SVG files containing script tags or event handlers
  • Developer onboarding security: Brief new hires on social engineering risks and recruiting scams; provide vetted resources for job seeking
  • Supply chain audits: Review build pipeline access logs for suspicious activity; audit deployed artifacts for unexplained changes
  • Threat hunting: Search logs for SVG file downloads, script execution from unusual paths, and outbound connections to known North Korean infrastructure
  • Hunt for OtterCookie indicators: Monitor for known C2 domains and IP addresses associated with previous Contagious Interview campaigns

    • For Job Platforms:


  • Implement stricter verification requirements for company accounts and job postings
  • Flag and investigate suspicious recruiting activity patterns
  • Warn candidates about social engineering tactics specific to the tech industry

    • ## HackWire Analysis


    This campaign illustrates a critical evolution in North Korean offensive operations: they're no longer relying on zero-day exploits or brute-force credential attacks. Instead, they're using social engineering combined with increasingly sophisticated obfuscation techniques—specifically SVG steganography—to bypass the layered defenses that modern security teams have built around executable detection.


    The *Contagious Interview* campaign's persistence and refinement suggest it's not a one-off experiment; it's a proven operational model generating measurable returns. The targeting of developers is particularly lucrative because it bypasses traditional perimeter security entirely: a compromise of a single developer machine can yield cryptocurrency holdings, corporate credentials, and access to build systems worth orders of magnitude more than a typical breach.


    What should concern defenders most is the accessibility of this attack: steganography in SVG files requires no sophisticated malware development capability. A moderately skilled threat actor can encode malicious scripts in image metadata using publicly available tools. As this technique becomes common knowledge, we should expect proliferation not just among nation-state actors but among lower-tier criminal groups as well.


    The defense isn't technical sophistication alone—it's verification discipline. Developers should independently verify any recruiter contact, test environment, or unusual request through established channels. Organizations must assume that their most security-conscious employees are still vulnerable to a well-executed social engineering campaign and design systems accordingly.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)