North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers

North Korean-linked hackers are hiding OTTERCOOKIE-aligned malware inside ordinary SVG flag images, turning a familiar part of a web project into a concealed delivery channel.

The operation targets software developers who believe they are completing a coding test for a job opportunity.

The victims receive a working e-commerce project through social-engineering messages, then are asked to run it locally.

Although the application appears legitimate, its assets contain fragments of malicious code that are quietly rebuilt when the server starts.

StepSecurity analysts have noted the growing danger of developer-focused attacks that hide harmful behavior until code is executed.

In this case, Elastic Security Labs and StepSecurity said in a report shared with Cyber Security News (CSN) that the activity is tracked as REF9403 and is linked to the long-running Contagious Interview operation.

The impact can be severe because developer machines often hold browser sessions, source-code access, cloud keys, and cryptocurrency wallets.

A single test project can therefore give attackers a route to valuable personal and corporate data without exploiting a software flaw.

North Korean Hackers Hide OTTERCOOKIE Malware

The attackers used SVG files depicting country flags, including AE.svg and AF.svg, in the project’s assets folder.

Each image looked harmless, but HTML comment blocks held Base64-encoded pieces of the payload, allowing the malware to avoid obvious inspection and security scanning.

A JavaScript file named serverValidation.js reads the SVG files, joins the fragments, and executes the recovered code.

The project remains functional, which makes the trap harder to spot, while the hidden routine runs automatically whenever the server boots.

The recovered toolkit has four main parts: a browser credential and cryptocurrency-wallet stealer, a file stealer, a clipboard collector, and a remote-access component using Socket.IO.

Together, they can collect sensitive information and give an operator a way to run commands on an infected system.

This approach expands on the group’s familiar fake-interview playbook, which has also used malicious packages and fabricated developer portfolios.

Readers tracking North Korean npm campaign activity can see how the same broader focus on developers has moved across repositories, package registries, and hosting services.

Fake Tests Raise Risk

The campaign reportedly began with job messages posted in a community Slack channel, followed by direct contact and a request to finish a coding assessment.

This routine recruitment-style interaction is important because it gives the project a credible reason to be downloaded and executed.

Organizations should treat unsolicited coding tasks as untrusted software, even when their code looks polished and the application works as promised.

Before running one, developers should review server startup files and asset directories, and look closely for dynamic code execution such as eval() or code that reads image files.

Teams that have run a suspect project should isolate the device, review browser-stored credentials and wallet extensions, and rotate exposed API keys, SSH keys, cloud credentials, GitHub and npm tokens.

This is especially important given OTTERCOOKIE credential theft features, which include cross-platform collection capabilities.

Network defenders should monitor or restrict connections to the identified rightwidth[.]dev infrastructure rather than relying only on install-script controls.

The payload starts at server launch, so package-manager protections aimed at installation scripts may not stop it; malicious package supply-chain threats also show why dependency and repository review must extend beyond initial installation.

Security teams can add checks that flag eval() in server-side JavaScript and inspect SVG comments for unusual encoded content.

They should also search project folders and download histories for the known archive names and serverValidation.js, then preserve evidence before rebuilding systems where the scope of exposure is unclear.

The incident is another reminder that image files and other static assets are not automatically safe.

Developers should verify the sender, inspect every part of an assessment repository, and avoid executing code from a job offer until it has been independently reviewed, particularly amid developer credential theft campaigns.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers appeared first on Cyber Security News.