[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_aZAqIlr9Frb7SHUCIt389urw8kS1wnfpaVQOAzTvCs":3},{"article":4,"iocs":52,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4ee400cb-f772-4ef9-a042-bcbec48059eb","Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images","fake-coding-tests-deliver-ottercookie-aligned-malware-hidden-in-svg-flag-images-7dc987","North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. \"Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a","North Korean threat actors linked to the Contagious Interview campaign are using steganography to hide malicious payloads within SVG flag images embedded in fake job postings and coding challenges. The four-stage payload delivers OtterCookie malware capable of stealing browser credentials, cryptocurrency wallets, files, and facilitating remote access. The campaign specifically targets software developers and highlights a new initial access vector through Slack job channel postings.","North Korean actors use steganography in SVG images within fake coding tests to deliver OtterCookie malware.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fnorth-korea-linked-hackers-hide.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEizZ8fzXjkeMlk_f1TKWczz8e4GHbNGTRPmaXHDPi86v4Ep0BqvGpKpOtpP_mtnHihu7kbII2nMxqQnQbjAhQkv6lkemsoIlzzS925QJKqkU5tgFHTxtSuRBllSUeZ3gpkJa51TAcggrQanY873B173p_hA-ow4sgftGDp4UgD3Torp7KswNuBp93-YOre5\u002Fs1600\u002Fnorthkorean-hacker.jpg","2026-07-17T13:48:56+00:00","2026-07-17T16:00:25.512503+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"North Korean threat actors \u002F DPRK-aligned","threat_actor",{"name":21,"type":22},"Contagious Interview","campaign",{"name":24,"type":25},"Elastic Security Labs","vendor",{"name":27,"type":25},"Microsoft",{"name":29,"type":30},"Socket.IO","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,56],{"type":35,"value":54,"context":55},"OtterCookie","Cross-platform malware module for credential and crypto wallet theft, file stealing, RAT, clipboard capture",{"type":35,"value":57,"context":58},"Socket.IO-based RAT","Remote access trojan component enabling shell command execution and persistent control",[27,24],{"controls":61,"vendors":142},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":92,"name":93,"problem":94,"products":95},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[96,103,111],{"vendor_slug":97,"vendor_name":27,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":120,"name":121,"problem":122,"products":123},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[124,131,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":128,"url":129,"description":130},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":133,"url":135,"description":136},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":138,"product_name":139,"url":140,"description":141},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[143],{"slug":144,"name":145,"logo_path":146,"roles":147},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"north-korean-actors-hide-malware-in-svg-images-targeting-developers-via-fake-job-tests","North Korean Actors Hide Malware in SVG Images Targeting Developers via Fake Job Tests","The Contagious Interview campaign exploits developers' trust in legitimate hiring workflows by embedding OtterCookie malware within SVG flag images using steganography — a technique that hides malicious code inside innocent-looking files. By distributing these payloads through Slack job channels and fake coding challenges, attackers bypass traditional email-based defenses and prey on candidates eager to impress potential employers. The four-stage infection chain ultimately steals browser credentials, cryptocurrency wallets, and sensitive files, while establishing persistent remote access. This campaign demonstrates how social engineering through professional contexts (job hunting, coding tests) can be just as dangerous as phishing emails, particularly when targeting high-value technical staff who may feel a false sense of security on developer-centric platforms.",[154,155,156,157,158,159,160,161,162,163,164],"CIS Control 3: Data Protection","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF DE.CM-4: Malicious Code Detection","MITRE ATT&CK T1566: Phishing (Spearphishing via Service)","MITRE ATT&CK T1027.003: Steganography","MITRE ATT&CK T1195: Supply Chain Compromise","GDPR Article 32: Security of Processing (credential\u002Fdata theft implications)",{}]