Full research report

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

The REF9403 campaign represents a deliberate evolution of the Contagious Interview playbook: embedding multi-stage payloads within SVG steganography allowed the threat actors to achieve zero antivirus detections across seven trojanised repositories simultaneously, significantly outpacing conventional signature-based controls. The payload assembler's use of a custom Base64 decoder — specifically to avoid triggering Buffer.from and atob() signatures — demonstrates active defensive research by the operators. The targeting of Elastic's own community Slack workspace as an initial access vector, rather than relying solely on broad npm supply chain poisoning, shows the actors are probing high-value security and developer communities directly, raising the prospect that similar lures are active in other professional forums. With C2 infrastructure spanning multiple rightwidth[.]dev subdomains and secondary Windows binary delivery, the campaign is operationally mature; its full victim scope remains unknown and is likely broader than the single Elastic community instance that triggered discovery.

What happened

In late May 2026, DPRK-aligned threat actors operating under the long-running Contagious Interview campaign — tracked by Elastic Security Labs as REF9403 — posted a fake developer job offer on Elastic's community Slack workspace using the persona 'Maxwell'. Interested developers were moved to direct messages and instructed to execute a trojanised e-commerce repository as a coding assessment. Malicious JavaScript payloads were concealed using steganography within HTML comments in SVG country flag image files in the repository's assets directory. Elastic published its findings on 17 July 2026 after discovering the campaign targeted its own community members.

Affected scope

Software developers on Windows, macOS, and Linux, particularly those with skills in Next.js, NestJS, PostgreSQL, and Auth.js. Cryptocurrency wallet holders are a primary financial target. Seven distinct trojanised repositories were identified; the full victim population beyond Elastic's Slack community is unknown. No specific organisations confirmed as victims.

Technical assessment

The attack embeds Base64-encoded payload fragments within HTML comment blocks distributed across multiple SVG flag image files (AE.svg, AF.svg, etc.) in the repository assets directory. A JavaScript assembler file (serverValidation.js) reconstructs fragments in alphabetical order and executes the payload via eval() on every server startup, using a custom Base64 decoder to avoid detection signatures associated with Buffer.from and atob(). The four-stage payload performs browser credential and cryptocurrency wallet exfiltration (targeting 25 wallet extensions and LevelDB stores), targeted file theft (SSH keys, cloud credentials, shell histories), persistent interactive remote access via Socket.IO, and continuous clipboard monitoring. A secondary Windows binary dropper fetches additional executables from C2 infrastructure. The THN article characterises AI coding tool configuration directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) as targeted for collection; this claim requires confirmation against the primary Elastic report, which separately describes a deliberate exclusion strategy for certain directory types.

Recommended defensive actions

  1. Block all rightwidth[.]dev subdomains (including ldb, upload, controller, file) and associated IPs 195.26.248[.]212 and 188.40.64[.]61 at network perimeter immediately.
  2. Establish a mandatory code review and sandboxed execution policy before running any externally-sourced or candidate-provided repository, particularly those shared during recruitment.
  3. Audit any recently executed third-party Node.js repositories for HTML comment blocks containing Base64 data within SVG image assets and for eval() calls or custom Base64 decoders in server initialisation scripts.
  4. Deploy endpoint alerts for outbound connections to unknown .dev domains and HTTPS calls to /api/service/makelog, /cldbs, or /upload endpoints originating from Node.js processes.
  5. Apply Elastic Security Labs YARA rules and detection queries published with the REF9403 advisory to identify existing compromise.

Uncertainties and evidence gaps

  • The total number of victims and whether trojanised repositories were distributed beyond Elastic's own Slack community is unknown.
  • Whether C2 infrastructure extends beyond the identified rightwidth[.]dev domain cluster has not been confirmed.
  • The THN article states AI coding tool directories (.claude, .cursor, .gemini, .windsurf, .pearai, .llama) are gathered by the malware; the Elastic source as fetched describes an exclusion strategy for AI tool directories. This contradiction is material and should be resolved by reading the primary Elastic report directly.
  • Precise attribution within DPRK's threat ecosystem — specifically whether REF9403 maps to Famous Chollima, UNC5342, or a distinct sub-cluster — is not resolved by the published evidence.
  • No Microsoft advisory URL for the March 2026 OtterCookie evolution findings cited in the THN article was independently located or verified.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessDeveloper voluntarily clones and executes a repository received via direct message on a community Slack channel following a fake job offer.
ComponentJavaScript server initialisation code within a trojanised Node.js e-commerce repository; SVG image asset files serving as steganographic payload carriers.
MechanismMalicious payload fragments are Base64-encoded and hidden in HTML comments within SVG files; a JavaScript assembler reconstructs and eval()s the full payload on server startup using a custom decoder to evade signature detection.
ImpactTheft of browser credentials, 25 cryptocurrency wallet extension stores, SSH keys, cloud credentials, and shell histories; persistent interactive shell access via Socket.IO; clipboard monitoring; secondary Windows binary implants dropped.
DetectionOutbound DNS or HTTPS to rightwidth[.]dev subdomains; eval() execution of dynamically assembled payloads in Node.js at startup; HTML comment blocks containing Base64 fragments within repository SVG assets; file read access to browser LevelDB stores and .aws or .ssh directories at process startup.
MitigationNo software patch applicable — the attack exploits social engineering and voluntary code execution. Block identified C2 infrastructure; enforce repository review before execution; deploy Elastic Security Labs detection rules from the REF9403 advisory.
Exploitation status

No CVE exploitation involved; campaign relies entirely on social engineering to induce voluntary code execution. Active delivery confirmed from late May 2026, with seven distinct trojanised repositories identified carrying zero antivirus detections at discovery.

Research process

The investigation began with a single THN article attributing a DPRK SVG steganography campaign to Elastic Security Labs under the tracking designation REF9403. The Elastic primary report was identified, fetched, and verified as the authoritative source, providing full technical detail including C2 IoCs, payload stage architecture, and SVG assembly mechanics. Three independent corroborating sources were fetched across separate domains — SilentPush, CyberScoop, and GBHackers — establishing broader Contagious Interview campaign context and OtterCookie as an independently confirmed DPRK malware family. No CVEs, public exploit code, or dedicated government advisories specific to this campaign were found, consistent with a purely social-engineering-driven operation.

  1. What are the precise claims in the original THN article and are they consistent with a known campaign?
    Fetched the THN article at its stated URL.
    thehackernews.com ↗

    Article attributes the campaign to Contagious Interview (DPRK), tracked as REF9403 by Elastic Security Labs; describes SVG steganography delivering a four-stage OtterCookie-aligned payload via fake Slack job postings. No CVEs stated.

    why Established the base claims requiring verification and identified Elastic Security Labs as the primary source for independent confirmation.

  2. Does the Elastic Security Labs primary report exist and substantiate the THN claims?
    Searched for the Elastic REF9403 report and fetched the direct URL returned.
    elastic.co ↗

    Report confirmed: campaign discovered 26 May 2026 via Elastic's own Slack; SVG steganography via HTML comment Base64 fragments; serverValidation.js assembler using eval() with custom decoder; four-stage payload; C2 on rightwidth[.]dev; seven trojanised repositories with zero AV detections at discovery.

    why Elevated confidence to high — the discovering organisation's own detailed technical report is the strongest available corroboration. Specific IoCs, hashes, and mechanics are sourced and verifiable.

  3. Is OtterCookie independently documented as a DPRK malware family outside Elastic's reporting?
    Searched for OtterCookie and Contagious Interview across multiple outlets.

    Multiple independent outlets confirm OtterCookie as an active DPRK tool: SilentPush (front company infrastructure), GBHackers (npm campaign), CyberScoop (evasive techniques), SecurityAffairs (197 malicious npm packages).

    why Confirmed that OtterCookie is a well-documented, independently corroborated malware family — not a single-source claim — strengthening attribution confidence.

  4. What does SilentPush's Contagious Interview research add to the campaign and actor picture?
    Fetched the SilentPush blog post on Contagious Interview front companies.
    silentpush.com ↗

    Confirms Contagious Interview infrastructure includes shell companies (BlockNovas LLC, Angeloper Agency, SoftGlide LLC) used to distribute BeaverTail, InvisibleFerret, and OtterCookie since at least July 2024. No CVEs. Extensive C2 and front-company IoCs documented.

    why Second independent domain corroborating OtterCookie's established role in the Contagious Interview toolkit and confirming the campaign's multi-year, well-resourced character.

  5. Does CyberScoop's reporting on DPRK evasive techniques independently confirm the actor and malware overlap?
    Fetched the CyberScoop article on North Korean evasive techniques.
    cyberscoop.com ↗

    October 2025 reporting from Cisco Talos and Google Threat Intelligence Group attributes related campaigns to Famous Chollima and UNC5342 using BeaverTail and OtterCookie with blockchain-based C2 (EtherHiding). Confirms actor cluster overlap from a different reporting period and technique.

    why Third independent domain confirming OtterCookie as a persistent DPRK instrument while surfacing attribution nuance: multiple sub-clusters may be operating under the Contagious Interview umbrella.

  6. Are there any CVEs, CISA advisories, or public exploit code relevant to this campaign?
    Searched specifically for CISA advisories and government publications covering OtterCookie or Contagious Interview in 2026.

    CISA maintains a North Korea publications page but no advisory specific to OtterCookie or the REF9403 SVG campaign was found. No CVEs identified across any source. No public PoC exists because no software vulnerability underlies the attack.

    why Absence of CVEs and government advisories confirms that defensive response must prioritise developer awareness, code review policy, and network-layer IoC blocking rather than patch management.

Named in this story
ActorsContagious InterviewDPRK (Democratic People's Republic of Korea)Famous ChollimaUNC5342
MalwareOtterCookieBeaverTailInvisibleFerret
TargetsSoftware developersCryptocurrency wallet holdersTechnology sector organisationsDeveloper community Slack workspaces

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok12 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok8 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1647 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok257 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok6800 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vendor & gov advisories1
Contagious Interview malware in SVG images: DPRK campaign — Elastic Security Labs elastic.co ↗

Primary technical advisory from the discovering organisation; includes payload architecture, C2 IoCs, SHA-256 hashes, and detection rules.

Analysis & research3
Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie silentpush.com ↗

Independent corroboration of Contagious Interview infrastructure, front companies, and OtterCookie's established role in the campaign toolkit.

North Korean operatives spotted using evasive techniques to steal data and cryptocurrency cyberscoop.com ↗

Third-party corroboration (Cisco Talos and Google TIG) linking Famous Chollima and UNC5342 to BeaverTail and OtterCookie via blockchain-based C2.

North Korean Hackers Abuse npm, GitHub, and Vercel to Spread OtterCookie Malware gbhackers.com ↗

Documents a parallel OtterCookie distribution channel via malicious npm packages, confirming multi-vector campaign posture.