MalwareJul 17, 2026

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean actors use steganography in SVG images within fake coding tests to deliver OtterCookie malware.

North Korean threat actors linked to the Contagious Interview campaign are using steganography to hide malicious payloads within SVG flag images embedded in fake job postings and coding challenges. The four-stage payload delivers OtterCookie malware capable of stealing browser credentials, cryptocurrency wallets, files, and facilitating remote access. The campaign specifically targets software developers and highlights a new initial access vector through Slack job channel postings.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Microsoft?

Get an email when a new story names Microsoft, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

The Contagious Interview campaign exploits developers' trust in legitimate hiring workflows by embedding OtterCookie malware within SVG flag images using steganography — a technique that hides malicious code inside innocent-looking files. By distributing these payloads through Slack job channels and fake coding challenges, attackers bypass traditional email-based defenses and prey on candidates eager to impress potential employers. The four-stage infection chain ultimately steals browser credentials, cryptocurrency wallets, and sensitive files, while establishing persistent remote access. This campaign demonstrates how social engineering through professional contexts (job hunting, coding tests) can be just as dangerous as phishing emails, particularly when targeting high-value technical staff who may feel a false sense of security on developer-centric platforms.

What helps against this

How we list vendors

Elastic research

Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleCrowdStrike Falcon Insight XDR WithSecure Elements XDR Huntress Managed EDR all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleMicrosoft Defender for Office 365 Proofpoint Core Email Protection Check Point Harmony Email & Collaboration all options
Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
For exampleSoSafe Awareness Platform Hoxhunt Huntress Managed Security Awareness Training all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — OtterCookie
malware — Socket.IO-based RAT

Entities

North Korean threat actors / DPRK-aligned (threat_actor)Contagious Interview (campaign)Elastic Security Labs (vendor)Microsoft (vendor)Socket.IO (technology)