North Korean Hackers Embed OTTERCOOKIE Malware in SVG Images to Backdoor Developers

Key Takeaways

• North Korean-backed hackers are deploying OTTERCOOKIE malware disguised within seemingly innocuous SVG image files.
• The campaign, dubbed “Contagious Interview,” targets software developers through fake job coding tests, leading to system compromise upon execution of the provided project.
• The malware, tracked as REF9403, can steal credentials, cryptocurrency wallets, files, and establish remote access, posing a significant risk to developer environments.
• The attack leverages social engineering and hidden code fragments in SVG assets, making detection challenging without careful scrutiny.

North Korean Hackers Conceal OTTERCOOKIE Malware in SVG Images

A new campaign linked to North Korean state-sponsored actors is utilizing an innovative method to distribute OTTERCOOKIE malware, embedding malicious code within standard SVG (Scalable Vector Graphics) flag images. This technique transforms common web assets into covert delivery mechanisms, bypassing traditional security measures.

The operation specifically targets software developers, luring them with what appears to be a legitimate coding challenge for a prospective job. Victims receive a fully functional e-commerce project via social engineering tactics and are instructed to run it locally. While the application functions as expected, its asset files contain fragmented malicious code that is silently reassembled and executed when the server initiates.

Analysts at StepSecurity have highlighted the escalating threat of developer-centric attacks that defer the execution of harmful payloads until runtime. Elastic Security Labs and StepSecurity said in a report shared with Cyber Security News (CSN) that this activity is identified as REF9403 and is part of the ongoing “Contagious Interview” operation. The repercussions of such a compromise can be severe, as developer workstations frequently contain sensitive data, including browser sessions, direct access to source code, cloud keys, and cryptocurrency wallets.

This allows a single compromised test project to provide attackers with a direct pathway to valuable personal and corporate assets, often without needing to exploit any software vulnerabilities.

Stealthy Malware Deployment via SVG Files

The attackers ingeniously utilized SVG files, such as AE.svg and AF.svg, representing country flags within the project’s asset directory. These images appear benign, yet they contain Base64-encoded segments of the OTTERCOOKIE payload embedded within HTML comment blocks. This method allows the malware to evade straightforward inspection and automated security scanning tools.

A JavaScript file, named serverValidation.js, is responsible for reading these SVG files, concatenating the hidden fragments, and executing the reconstructed malicious code. The e-commerce project continues to operate without interruption, making the compromise difficult to detect, while the concealed routine automatically activates each time the server starts.

The recovered OTTERCOOKIE toolkit is comprehensive, comprising four primary modules: a browser credential and cryptocurrency-wallet stealer, a file exfiltration component, a clipboard data collector, and a remote-access capability leveraging Socket.IO. Collectively, these tools enable the collection of sensitive information and provide threat actors with the ability to execute commands on an infected system.

This refined approach builds upon the group’s established fake-interview methodology, which has previously involved malicious packages and fabricated developer portfolios. Observers tracking North Korean npm campaign activity can discern a consistent focus on targeting developers across various repositories, package registries, and hosting platforms.

Mitigating Risks from Fake Coding Assessments

The campaign reportedly initiates with job postings in community Slack channels, followed by direct communication and a request for the developer to complete a coding assessment. This seemingly routine recruitment interaction is crucial, as it provides a credible pretext for the victim to download and execute the malicious project.

Organizations must treat unsolicited coding tasks as untrusted software, irrespective of their apparent professionalism or the functionality of the application. Before running any such project, developers should meticulously review server startup files and asset directories, paying close attention to any instances of dynamic code execution, such as eval(), or code designed to read image files.

Teams that have executed a suspicious project should immediately isolate the affected device. Furthermore, they should review all browser-stored credentials and wallet extensions, and promptly rotate any exposed API keys, SSH keys, cloud credentials, and GitHub or npm tokens. This is particularly vital given the OTTERCOOKIE malware’s extensive credential theft features, which include cross-platform collection capabilities.

Network defenders should actively monitor and restrict connections to the identified malicious infrastructure, specifically rightwidth[.]dev, rather than relying solely on installation-script controls. Since the payload activates at server launch, package manager protections targeting installation scripts may not prevent compromise. The prevalence of malicious package supply-chain threats further underscores why dependency and repository scrutiny must extend beyond the initial installation phase.

Security teams can implement additional checks to flag eval() calls in server-side JavaScript and inspect SVG comments for unusual encoded content. They should also search project folders and download histories for the known archive names and the serverValidation.js file. If a compromise is suspected, preserve all evidence before rebuilding systems where the full extent of exposure is unclear.

This incident serves as a stark reminder that image files and other static assets are not inherently safe. Developers must verify the sender’s legitimacy, thoroughly inspect every component of an assessment repository, and refrain from executing code from an unsolicited job offer until it has undergone an independent security review, especially in the current climate of developer credential theft campaigns.

What You Should Do

• Exercise Extreme Caution with Unsolicited Code: Treat all coding challenges or projects from unknown sources as potentially malicious.
• Manual Code Review: Before executing any downloaded project, manually inspect server startup files, asset directories, and JavaScript files for suspicious functions like eval() or code that reads image files in an unusual manner.
• Isolate and Remediate: If a suspicious project has been run, immediately isolate the affected machine, review all browser-stored credentials and wallet extensions, and rotate all exposed API keys, SSH keys, cloud credentials, and GitHub/npm tokens.
• Network Monitoring: Implement monitoring and restriction policies for connections to known malicious infrastructure, such as rightwidth[.]dev.
• Enhanced Security Scans: Configure security tools to scan SVG comments for encoded content and flag dynamic code execution functions in server-side JavaScript.
• Incident Response: If a compromise is suspected, collect and preserve all Indicators of Compromise (IoCs) before rebuilding systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.