The New Face of Contagious Interview

The Contagious Interview campaign has been a thorn in the side of cybersecurity teams for months. But its latest evolution is raising alarms. North Korean threat actors have added a new trick: hiding malicious payloads inside SVG image files using steganography.

Security researchers recently uncovered a wave of attacks where fake job postings lure developers into running coding challenges. Those challenges, it turns out, are Trojan horses. Any user who ran the project ended up with a four-stage payload aligned with OtterCookie malware — a browser credential and crypto wallet stealer, a file stealer, and more.

How the SVG Steganography Attack Works

Steganography isn’t new. But using SVG files — the vector image format widely supported in browsers — is a clever twist. The malicious code hides in plain sight within the image’s XML structure, making it nearly invisible to traditional scanners.

The attack chain is deceptively simple:

• Victims receive a fake coding challenge via a job interview invitation.
• The project includes an SVG image that appears harmless.
• When the code runs, it extracts hidden payloads from the SVG’s metadata.
• The payload installs OtterCookie, which steals credentials, crypto wallet data, and files.

This multi-stage approach is designed to evade detection. Each step is small and innocuous on its own, but together they form a devastating pipeline.

Why SVG Files Are the Perfect Cover

SVG files are XML-based, which means they can contain arbitrary data in comments, attributes, or even within the image paths themselves. Security tools that scan for malware often overlook these files because they’re not executable by default.

Attackers exploit this blind spot. They embed encrypted blobs or base64-encoded strings inside the SVG, then use a script in the coding challenge to decode and execute them. The result? A stealthy delivery mechanism that slips past most defenses.

This isn’t just a technical curiosity. It’s a practical threat for anyone in tech, especially developers who are actively job hunting.

OtterCookie: What It Steals and How

OtterCookie is a modular stealer that targets:

• Browser credentials, including saved passwords and cookies
• Crypto wallet extensions and private keys
• Files matching specific extensions, like documents and source code
• System information for further exploitation

The malware communicates with a command-and-control server, exfiltrating data in real time. Researchers note that it’s often paired with other tools, making it a versatile component in a larger arsenal.

For victims, the damage can be severe. Stolen crypto wallets can be drained within minutes. Corporate credentials can lead to network intrusions and data breaches.

How to Protect Yourself from Fake Job Scams

If you’re a developer, this campaign is a direct threat. Here’s how to stay safe:

1. Verify the recruiter. Check the company’s official domain and email format. Be wary of unsolicited interview invitations.
2. Inspect the code. Before running any coding challenge, review the project files. Look for suspicious scripts, obfuscated code, or unusual image files.
3. Run in a sandbox. Execute unknown code in a virtual machine or isolated environment to contain any potential damage.
4. Monitor your accounts. Regularly check your browser extensions and crypto wallets for unauthorized access.

These steps won’t guarantee safety, but they drastically reduce your risk. The threat landscape is evolving, and so must your defenses.

The Bigger Picture: North Korea’s Cyber Operations

This campaign is part of a broader pattern. North Korean state-sponsored hackers have long used social engineering to infiltrate tech companies, steal intellectual property, and generate revenue through crypto theft. The Contagious Interview campaign is just one example of their relentless innovation.

Security researchers continue to track these groups, but the challenge is immense. As defenses improve, attackers adapt. SVG steganography is the latest adaptation, and it won’t be the last.

Staying informed is your best weapon. Follow cybersecurity news, update your tools, and always question what’s in front of you. A single suspicious file could be the difference between a secure career and a devastating breach.

Emergency Action Required for Federal Agencies

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) moved quickly on Thursday, adding a freshly patched Microsoft SharePoint Server flaw to its Known Exploited Vulnerabilities (KEV) catalog. The designation means Federal Civilian Executive Branch (FCEB) agencies have a hard deadline: apply the fixes by July 19, 2026.

This isn’t a theoretical risk. The vulnerability, tracked as CVE-2026-58644, carries a CVSS score of 9.8 — critical, with a capital C. It’s a deserialization bug that attackers are already exploiting in the wild.

What Makes CVE-2026-58644 So Dangerous?

Deserialization flaws are nasty. They let an attacker manipulate serialized data passed to the application, potentially executing arbitrary code on the server. For SharePoint, that’s a crown jewel target — the server often sits deep inside corporate networks with broad access to files, credentials, and other systems.

The CVSS score of 9.8 reflects the severity: no user interaction required, low attack complexity, and the potential for full compromise of the affected server. Think about what a successful exploit means. An attacker gains a foothold, then moves laterally. SharePoint is frequently the starting point for ransomware gangs and nation-state actors alike.

Why the Zero-Day Label?

Microsoft patched the flaw before CISA’s announcement, but the fact that it was exploited before a fix existed makes it a zero-day. The window between discovery and patch is when the damage happens. CISA’s KEV listing confirms that window was used — and likely continues to be used by threat actors targeting unpatched systems.

What Federal Agencies Must Do Now

The binding operational directive (BOD) 22-01 requires FCEB agencies to remediate KEV-listed vulnerabilities by the specified due date. For CVE-2026-58644, that’s July 19, 2026. Miss it, and you’re in violation of federal policy. But the real cost isn’t bureaucratic — it’s the risk of a breach.

Beyond the federal sphere, CISA’s KEV catalog has become a de facto checklist for security teams everywhere. If you run Microsoft SharePoint Server, consider this your wake-up call. Patch immediately. Don’t wait for the 19th.

Practical Steps for SharePoint Administrators

Here’s what you should do today, not next week:

• Apply the latest Microsoft security update — the patch for CVE-2026-58644 is included in the June 2026 Patch Tuesday release. Verify your installation is current.
• Check your logs — look for unusual deserialization activity or unexpected process executions on SharePoint servers. Indicators of compromise may exist if you were targeted before patching.
• Harden your environment — restrict network access to SharePoint servers, enforce least-privilege accounts, and monitor for anomalous behavior.
• Review CISA’s KEV catalog regularly — it’s updated frequently. Make it part of your weekly threat intelligence routine.

Broader Implications for Enterprise Security

This isn’t an isolated incident. SharePoint has been a recurring target — remember the ProxyLogon and ProxyShell issues in Exchange? The pattern is consistent: on-premises collaboration servers are high-value targets. They hold data, they’re often internet-facing, and they’re complex to patch.

If you’re running SharePoint Server on-premises, the message is clear. You’re in the crosshairs. The shift to cloud-based services like SharePoint Online might reduce some risk, but hybrid deployments still carry on-premises components that need attention.

For security teams, the KEV catalog is a gift. It tells you exactly what’s being exploited right now. The hard part is acting on it. Prioritize CVE-2026-58644. Schedule the maintenance window. Communicate the urgency to stakeholders.

One more thing: don’t assume your vulnerability scanner caught this. Deserialization bugs can be tricky to detect. Manual verification of the SharePoint build number is a good sanity check.

The bottom line? This is a critical, actively exploited vulnerability with a federal deadline. Treat it with the seriousness it deserves. Patch. Verify. Monitor. That’s the playbook.

The Hidden Web of Ad Tracking, Now Visible

Ever wonder who’s actually behind those ads that follow you around the internet? Or which companies are quietly harvesting your data from the apps on your phone? The answers have always been semi-public, but buried in technical files that most people can’t parse.

That’s changing. A new free service called DecryptAds scrapes and cross-references the adtech declaration files that websites and apps are required to publish. The result? You can now see the full roster of companies tracking you on any site — often dozens or even hundreds of them.

What DecryptAds Reveals About Your Favorite Sites

Type in a domain like espn.com, and DecryptAds pulls together data from three key public files:

• ads.txt — lists all adtech companies and data brokers allowed to run ads or collect data on a site
• app-ads.txt — the same info for mobile and smart TV apps
• buyers.json / sellers.json — shows who’s buying, selling, or reselling ad inventory

For ESPN, that reveals 143 ad partners and 19 registered data brokers. Nearly half of those brokers are collecting geolocation data from visitors who aren’t blocking ads. Three others openly admit to device fingerprinting and collecting sensitive personal information.

Data Broker Registrations Are Growing

This data broker information is becoming available thanks to new laws in California, Oregon, Texas, and Vermont that require brokers to register if they buy or sell consumer data from those states. DecryptAds founder Zach Edwards, a threat researcher at security firm Infoblox, says the service was built to approach adtech from a security perspective.

“It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.”

High-Risk Ad Partners You Never Knew About

One of the most striking features is the Geo-Risk warning. DecryptAds flags adtech partners based in countries like China, Russia, Cyprus, and the UAE — places with strong financial or political ties to adversarial nations.

Take the military news sites. A search across armytimes.com, airforcetimes.com, defensenews.com, and others shows they all allow a Russian adtech firm called Between Digital to serve ads and track users. The company lists a New York address, but its publisher offers are processed through Alfa Bank — one of Russia’s largest banks, placed under U.S. sanctions in 2022.

Between Digital is collecting ad data on approximately 55,000 partner websites. And here’s the kicker: on about two-thirds of those sites, the company is listed as both a publisher and a reseller.

“It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties,” Edwards explained. “For years we’ve had almost no one policing these ads.txt and app-ads.txt files.”

Opera Browser’s Chinese Ties Exposed

Many users don’t know that Opera has been majority-owned by Chinese company Kunlun Tech since 2016. DecryptAds shows Opera.com has 27 registered data brokers collecting information — including 15 adtech partners in the UAE, six in China, three in Cyprus, and two in Russia. That’s still only seven percent of Opera’s total adtech partners.

Legal Dossiers and Quiet Removals

The Legal Dossier lookup is a rabbit hole. It takes several minutes per search but returns a treasure trove: who owns a domain, when it was registered, and how it connects to other adtech entities.

For example, a dossier on a dormant domain linked to the Fengwo Group — the same Chinese company behind malicious streaming stick apps — revealed a shared seller ID with a gaming website. Pivoting on that ID exposed hundreds of low-quality sites within Russia’s Yandex ad system.

DecryptAds also tracks quiet removals — when ad exchanges silently remove a seller from their sellers.json file without public explanation. This practice lets dodgy adtech firms escape accountability. The quiet removals feed records and correlates these removals across exchanges, making patterns visible.

Malvertising and the Rise of AI Slop Sites

Edwards says malicious ads are increasingly found on AI-generated content farms rather than major sites like ESPN.

“None of these slop AI content farms are paying for that kind of protection,” he said. “They’re just signing up the lowest quality partners, and it essentially becomes a greased rail to target the users of those sites with malicious ads.”

These AI slop sites cover everything from home improvement to recipes, and they’re prime vectors for malvertising attacks. The fix, Edwards argues, is for ad networks to share the supply chain object (SCO) — structured data attached to each bid request that reveals every intermediary in the ad delivery chain. Currently, that data is only served server-side, making it nearly impossible to trace malicious ads back to their source.

What You Can Do Right Now

The obvious takeaway? Block ads everywhere. Security experts broadly endorse this because it also blocks the tracking that powers these ad networks.

Here’s what works:

• uBlock Origin — the gold standard for desktop browsers, also works on Android via Firefox
• Adblock Plus — a decent option for iPhone and iPad users
• NoScript — blocks all non-approved JavaScript, but requires patience to manage
• Pi-hole on a Raspberry Pi — blocks ads network-wide for every device in your home, the most secure and scalable option

But here’s a warning: ad blockers do little against tracking inside mobile apps. And more sites are pushing apps — not because the experience is better, but because apps make it easier to collect precise data and resell it.

“The cold truth is that big web destinations tend to get pushy with their apps because they make it easier to keep you on their platforms longer,” Edwards says. Many of these apps also opt users into training AI models by default.

So before you install that next app, check its DecryptAds listing. It might just show you who’s really behind it.