North Korean-linked hackers are hiding OTTERCOOKIE-aligned malware inside ordinary SVG flag images, turning a familiar part of a web project into a concealed delivery channel. <\/p>\n
The operation targets software developers who believe they are completing a coding test for a job opportunity.<\/a><\/p>\n The victims receive a working e-commerce project through social-engineering messages, then are asked to run it locally. <\/p>\n Although the application appears legitimate, its assets contain fragments of malicious code that are quietly rebuilt when the server starts.<\/a><\/p>\n StepSecurity analysts have noted the growing danger of developer-focused attacks that hide harmful behavior until code is executed. <\/p>\n In this case, Elastic Security Labs and StepSecurity said in a report<\/a> shared with Cyber Security News (CSN) that the activity is tracked as REF9403 and is linked to the long-running Contagious Interview operation.<\/p>\n The impact can be severe because developer machines often hold browser sessions, source-code access, cloud keys, and cryptocurrency wallets. <\/p>\n A single test project can therefore give attackers a route to valuable personal and corporate data without exploiting a software flaw.<\/a><\/p>\n The attackers used SVG files depicting country flags, including AE.svg and AF.svg, in the project\u2019s assets folder. <\/p>\n Each image looked harmless, but HTML comment blocks held Base64-encoded pieces of the payload, allowing the malware to avoid obvious inspection and security scanning.<\/a><\/p>\n A JavaScript file named serverValidation.js reads the SVG files, joins the fragments, and executes the recovered code. <\/p>\n The project remains functional, which makes the trap harder to spot, while the hidden routine runs automatically whenever the server boots.<\/p>\n The recovered toolkit has four main parts: a browser credential and cryptocurrency-wallet stealer, a file stealer, a clipboard collector, and a remote-access component using Socket.IO. <\/p>\n Together, they can collect sensitive information and give an operator a way to run commands on an infected system.<\/a><\/p>\n This approach expands on the group\u2019s familiar fake-interview playbook, which has also used malicious packages and fabricated developer portfolios. <\/p>\n Readers tracking\u00a0North Korean npm campaign activity<\/a>\u00a0can see how the same broader focus on developers has moved across repositories, package registries, and hosting services.<\/a><\/p>\n The campaign reportedly began with job messages posted in a community Slack channel, followed by direct contact and a request to finish a coding assessment. <\/p>\n This routine recruitment-style interaction is important because it gives the project a credible reason to be downloaded and executed.<\/a><\/p>\n Organizations should treat unsolicited coding tasks as untrusted software, even when their code looks polished and the application works as promised. <\/p>\n Before running one, developers should review server startup files and asset directories, and look closely for dynamic code execution such as eval() or code that reads image files.<\/a><\/p>\n Teams that have run a suspect project should isolate the device, review browser-stored credentials and wallet extensions, and rotate exposed API keys, SSH keys, cloud credentials, GitHub and npm tokens. <\/p>\n This is especially important given\u00a0OTTERCOOKIE credential theft features<\/a>, which include cross-platform collection capabilities.<\/p>\n Network defenders should monitor or restrict connections to the identified rightwidth[.]dev infrastructure rather than relying only on install-script controls. <\/p>\n The payload starts at server launch, so package-manager protections aimed at installation scripts may not stop it;\u00a0malicious package supply-chain threats<\/a>\u00a0also show why dependency and repository review must extend beyond initial installation.<\/p>\n Security teams can add checks that flag eval() in server-side JavaScript and inspect SVG comments for unusual encoded content. <\/p>\n They should also search project folders and download histories for the known archive names and serverValidation.js, then preserve evidence before rebuilding systems where the scope of exposure is unclear.<\/a><\/p>\n The incident is another reminder that image files and other static assets are not automatically safe. <\/p>\n Developers should verify the sender, inspect every part of an assessment repository, and avoid executing code from a job offer until it has been independently reviewed, particularly amid\u00a0developer credential theft campaigns<\/a>.<\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\n![\"Dendreo](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEghxiehy1AaynZugluTsyFd3bsWGu__-7LNvo7gGuztfsST61RggUkycACaEpPImLqi0VsfULkbEPImSbrOs61XzKm1sbD8RNKGf7fkHgLphB4xTdq-E7bKAhESqZNTgfrsqcPBj9sJH_qK-HUjgrdGYtFb1v1EvYzvWlevj8hRMHEUEMKk_1HApvcNHK4\/s1600\/Dendreo%2520repository%2520%28Source%2520-%2520StepSecurity%29.webp?ssl=1\")
North Korean Hackers Hide OTTERCOOKIE Malware<\/strong><\/h2>\n
![\"Fastlane](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhn7F-fOemr4zqnSpckzTmyZoeDvct04aWfmoRDvNdXmbTesj5tDz4Yhp1h-LW6fQi-1WLiqW2vICG7ydvcmaRliHKg2fw3msKOG0FORT73kdITjBFPzs4t3pPJ7p_bX5J8y8PlK0Q9oXEDmRQ5U5SKoYggzo1990OsHvXGF8vbxq0wgHAJXwsJhyphenhyphentv8Sc\/s1600\/Fastlane%2520plugin%2520repository%2520%28Source%2520-%2520StepSecurity%29.webp?ssl=1\")
Fake Tests Raise Risk<\/strong><\/h2>\n