North Korea-Linked Hackers Hide Malware in SVG Flag Images to Steal Developer Credentials
North Korean threat actors have been observed using steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges.
Intelligence analysis by Llama
North Korean hackers are using fake job postings and coding challenges to steal developer credentials and cryptocurrency wallets. They are hiding malware in SVG flag images to sidestep detection.
Imagine you're a developer looking for a new job. You see a posting for a cool project that sounds like a great opportunity. But, unbeknownst to you, the project is actually a way for hackers to steal your sensitive data and cryptocurrency wallets. They're hiding the malware in SVG flag images to make it harder to detect. This is a new way for hackers to get into your system and steal your information.
Analysis
A New Initial Access Avenue for Contagious Interview Campaigns
The findings once again highlight the continued targeting of software developers by state-sponsored hackers aligned with the Democratic People's Republic of Korea (DPRK) with an aim to steal sensitive data and plunder cryptocurrency wallets. The activity is being tracked under the moniker REF9403. The cybersecurity arm of the Dutch enterprise search and observability platform said it discovered the campaign after the threat actors targeted members of its community Slack workspace with social engineering lures for purported job offers, highlighting a new initial access avenue not previously documented in attacks associated with Contagious Interview, a sophisticated social engineering operation ongoing since at least December 2022. The messages, posted by a user named Maxwell on the #jobs Slack channel in late May 2026, sought an experienced developer to help with upgrading their e-commerce platform to a "modern, scalable architecture using Next.js (v14), NestJS, PostgreSQL, and Auth.js" along with Stripe integration. Those who expressed interest in the opportunity were moved into direct messages that instructed them to complete a coding assessment as part of the job offer, a standard ploy observed in Contagious Interview campaigns. The assignment involved executing a trojanized repository containing malware designed to exfiltrate valuable data and configuring a Socket.IO backdoor.
Steganography in SVG Flag Images
The repositories distributed as part of the scheme incorporate fully functional code but also embed malicious code in the form of SVG images to sidestep detection. "While these legitimate-looking projects run perfectly fine, the malicious code is triggered silently behind-the-scenes," Elastic said. The payloads are split into base64 fragments inside HTML comments across every SVG flag image inside an assets directory. These files appear to be normal images of country flags (AE.svg, AF.svg), but each file contains an injected comment block with Base64-encoded data. The payload is then assembled together by a JavaScript file ("serverValidation.js") present in the repository. The attack chain is engineered such that the malware is executed on each server boot.
Overlap with OtterCookie
Elastic said the main payload shares overlap with OtterCookie , a cross-platform malware that first emerged in September 2024. OtterCookie "evolved from a basic tool for executing remote commands and searching for crypto keys into a modular program capable of broader data theft with a capability to check for VM environments, install communication clients like socket.io for C2, exfiltrate information, executes arbitrary shell commands, load other modules to collect specific intended data and reports results," Microsoft noted back in March. The malware incorporates four distinct modules that allow it to harvest data from web browsers and cryptocurrency wallets, collect files matching a specific list of extensions, facilitate persistent remote control using a Socket.IO-based trojan that can execute shell commands, capture clipboard content, and drop Windows executables. Among the files gathered by OtterCookie include artificial intelligence (AI) coding tooling extensions such as .claude, .cursor, .gemini, .windsurf, .pearai, and .llama, suggesting the threat actor is actively refining its arsenal to hoover as much information as possible.
Implications
It's worth noting that the malware also exhibits some functional overlaps with a data stealer and trojan distributed via bogus npm packages masquerading as Rollup polyfill tooling, suggesting the threat actors are pursuing multiple vectors for propagation. "This campaign reinforces that developers remain a prime target, where the compromise of a single individual can provide the initial access needed to enable far-reaching supply chain attacks against downstream organizations," Elastic said. "The success of these operations underscores how compromising an individual developer can provide a path to much broader organizational impact."
Key points
- North Korean threat actors are using fake job postings and coding challenges to steal developer credentials and cryptocurrency wallets.
- The malware is hidden in SVG flag images to sidestep detection.
- The campaign is tracked under the moniker REF9403.
- The threat actors are targeting members of community Slack workspaces with social engineering lures.
- The malware incorporates four distinct modules to harvest data from web browsers and cryptocurrency wallets.
If this development plays out positively, it could lead to increased awareness and vigilance among developers and organizations about the risks of social engineering and supply chain attacks. This could result in improved security measures and a reduction in the number of successful attacks.
On the other hand, if this development plays out negatively, it could lead to a significant increase in the number of successful attacks, resulting in the theft of sensitive data and cryptocurrency wallets. This could have serious consequences for individuals and organizations, including financial losses and reputational damage.
