The New Face of Contagious Interview
The Contagious Interview campaign has been a thorn in the side of cybersecurity teams for months. But its latest evolution is raising alarms. North Korean threat actors have added a new trick: hiding malicious payloads inside SVG image files using steganography.
Security researchers recently uncovered a wave of attacks where fake job postings lure developers into running coding challenges. Those challenges, it turns out, are Trojan horses. Any user who ran the project ended up with a four-stage payload aligned with OtterCookie malware — a browser credential and crypto wallet stealer, a file stealer, and more.
How the SVG Steganography Attack Works
Steganography isn’t new. But using SVG files — the vector image format widely supported in browsers — is a clever twist. The malicious code hides in plain sight within the image’s XML structure, making it nearly invisible to traditional scanners.
The attack chain is deceptively simple:
- Victims receive a fake coding challenge via a job interview invitation.
- The project includes an SVG image that appears harmless.
- When the code runs, it extracts hidden payloads from the SVG’s metadata.
- The payload installs OtterCookie, which steals credentials, crypto wallet data, and files.
This multi-stage approach is designed to evade detection. Each step is small and innocuous on its own, but together they form a devastating pipeline.
Why SVG Files Are the Perfect Cover
SVG files are XML-based, which means they can contain arbitrary data in comments, attributes, or even within the image paths themselves. Security tools that scan for malware often overlook these files because they’re not executable by default.
Attackers exploit this blind spot. They embed encrypted blobs or base64-encoded strings inside the SVG, then use a script in the coding challenge to decode and execute them. The result? A stealthy delivery mechanism that slips past most defenses.
This isn’t just a technical curiosity. It’s a practical threat for anyone in tech, especially developers who are actively job hunting.
OtterCookie: What It Steals and How
OtterCookie is a modular stealer that targets:
- Browser credentials, including saved passwords and cookies
- Crypto wallet extensions and private keys
- Files matching specific extensions, like documents and source code
- System information for further exploitation
The malware communicates with a command-and-control server, exfiltrating data in real time. Researchers note that it’s often paired with other tools, making it a versatile component in a larger arsenal.
For victims, the damage can be severe. Stolen crypto wallets can be drained within minutes. Corporate credentials can lead to network intrusions and data breaches.
How to Protect Yourself from Fake Job Scams
If you’re a developer, this campaign is a direct threat. Here’s how to stay safe:
- Verify the recruiter. Check the company’s official domain and email format. Be wary of unsolicited interview invitations.
- Inspect the code. Before running any coding challenge, review the project files. Look for suspicious scripts, obfuscated code, or unusual image files.
- Run in a sandbox. Execute unknown code in a virtual machine or isolated environment to contain any potential damage.
- Monitor your accounts. Regularly check your browser extensions and crypto wallets for unauthorized access.
These steps won’t guarantee safety, but they drastically reduce your risk. The threat landscape is evolving, and so must your defenses.
The Bigger Picture: North Korea’s Cyber Operations
This campaign is part of a broader pattern. North Korean state-sponsored hackers have long used social engineering to infiltrate tech companies, steal intellectual property, and generate revenue through crypto theft. The Contagious Interview campaign is just one example of their relentless innovation.
Security researchers continue to track these groups, but the challenge is immense. As defenses improve, attackers adapt. SVG steganography is the latest adaptation, and it won’t be the last.
Staying informed is your best weapon. Follow cybersecurity news, update your tools, and always question what’s in front of you. A single suspicious file could be the difference between a secure career and a devastating breach.
