North Korean state-sponsored hackers are employing a sophisticated new tactic, dubbed "Contagious Interview," to compromise developers by embedding malware within seemingly benign coding challenges. The campaign, tracked as REF9403, leverages steganography to hide multi-stage payloads within SVG image files, which have gone undetected by all major antivirus vendors.
The attack begins with threat actors posting fake job offers in developer community forums, such as Slack workspaces. Once a developer expresses interest, the conversation moves to direct messages, where the individual is asked to complete a "test challenge" involving a trojanized code repository. Elastic Security Labs, which discovered this campaign after its own community Slack was targeted, confirmed that running these projects leads to the silent execution of malware.
The malicious repositories, which include names like `next-ecommerce-private-main.zip` and `shopping-platform.rar`, contain fully functional code, often copied from legitimate open-source projects. For instance, one observed sample was a tampered version of GreatStackDev's GoCart Next.js e-commerce template. Small, malicious code snippets are inserted at various points, using benign variable names to evade suspicion.
A key element of the attack is the use of steganography within SVG flag images (e.g., `AE.svg`, `AF.svg`) located in an `assets` directory. Each image contains an injected HTML comment block with Base64-encoded data. A JavaScript file within the repository, `serverValidation.js`, reassembles these Base64 fragments from all flag images in alphabetical order to construct the malicious payload.
This reassembled data is then decoded using a custom Base64-decoding function named `Check()` and executed via `eval()`, a technique that helps bypass common detections that might trigger with standard decoding methods like `Buffer.from` or `atob()`. The execution is triggered on every server start, as the `server/index.js` file calls `runServerValidation()` after initial middleware setup, meaning the payload executes whenever `npm run dev` or `npm start` commands are used.
The distributed malware is a four-stage payload exhibiting characteristics aligned with OTTERCOOKIE, a known North Korean infostealer. It includes a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based remote access trojan (RAT), and a clipboard stealer. While historically OTTERCOOKIE and BEAVERTAIL were distinct, with BEAVERTAIL acting as a first-stage stealer and OTTERCOOKIE as a later-stage C2-driven infostealer, the observed samples show a convergence into an all-in-one package.
Attribution to North Korea and the Contagious Interview campaign is based on significant code similarity, behavioral patterns, and shared infrastructure with previously documented activities. The malicious payloads share code with OTTERCOOKIE, first identified by NTT Security in December 2024, and exhibit matching strings and script layouts. The observed API endpoints, such as `/api/service/makelog`, `/api/service/process/uid/cldbs`, and `/upload`, also align with infrastructure previously linked by JFrog Security research.
Developers remain a prime target for such attacks, as the compromise of a single individual can provide initial access for broader supply chain attacks. Some developers have reported suspicious activity after running these challenges, while others have unknowingly pushed the backdoored repositories to platforms like GitHub.
