Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

Key Points:

• North Korean threat actors linked to the Contagious Interview campaign are using steganography in SVG images to deliver a multi-stage malware payload, including a credential and crypto wallet stealer, a file stealer, and a remote access trojan (RAT).
• The campaign targets software developers through fake job postings, aiming to steal sensitive data and cryptocurrency. The malware is designed to execute silently and persistently on infected systems.
• Security teams should implement strict vetting of job offers, monitor for unusual activity in development environments, and educate developers about the risks of executing unknown code.

Technical Details: The malware, aligned with OTTERCOOKIE, utilizes base64-encoded payloads hidden within SVG image files. This technique allows it to evade detection while executing malicious actions on compromised systems.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1046 - Network Service Discovery (Discovery)
• T1059.001 - Command and Scripting Interpreter: PowerShell (Execution)
• T1203 - Exploit Public-Facing Application (Initial Access)

IOCs Mentioned: None mentioned.