North Korean-linked threat actors are executing the "Contagious Interview" campaign, targeting developers through fraudulent recruitment. The attack utilizes SVG steganography to embed malicious payloads within graphic assets and leverages malicious npm packages with multi-layer dependency nesting to deliver the OtterCookie infostealer. The malware executes a four-stage payload to exfiltrate browser credentials, session cookies, cryptocurrency wallet data, and sensitive local files. This sophisticated approach bypasses traditional static analysis and EDR via supply chain compromise and steganographic evasion, posing a severe risk to technical workstations and developer environments.

• Threat Campaign: Contagious Interview

  • Targets software developers using social engineering via fake job offers and technical coding assessments.
  • Distributes malicious "coding tests" through fraudulent project repositories to trick victims into execution.
  • Attributed to state-sponsored North Korean actors focusing on high-value technical intelligence and developer workstations.

• Attack Vectors: SVG Steganography and npm Supply Chain

  • Utilizes SVG steganography to hide executable data within graphic files, such as flag images, to evade EDR and static scanners.
  • Employs npm supply chain attacks using a two-layer dependency nesting strategy to bury the malicious payload.
  • Triggers payload extraction and subsequent execution once the developer initializes the project or installs dependencies.

• Technical Execution: Four-Stage Payload Chain

  • Implements a four-stage execution sequence to move from initial package installation to full system compromise.
  • Employs advanced obfuscation techniques within the npm dependency chain to hinder reverse engineering and automated detection.
  • Establishes communication with external Command and Control (C2) infrastructure for data exfiltration.

• Malware Capabilities: OtterCookie Data Exfiltration

  • Functions as a potent infostealer designed for targeted extraction of browser-stored credentials and session cookies.
  • Specifically scans for and exfiltrates private keys, seeds, and sensitive data from cryptocurrency wallets.
  • Conducts broad scans of the local file system to identify and steal sensitive documents and configuration files.

• Defensive Actions and Mitigation

  • Implement rigorous auditing of npm dependencies, focusing on deep-nesting patterns and unverified maintainers.
  • Deploy advanced file analysis tools capable of detecting anomalous data blocks or embedded scripts within SVG files.
  • Enforce the use of isolated virtual environments (sandboxes) when evaluating third-party recruitment code or external repositories.