Contagious Interview malware in SVG images: DPRK campaign

The Contagious Interview campaign, attributed to a DPRK-aligned threat actor tracked as REF9403, targets developers by posting fake job offers and coding challenges on developer forums. The attackers provide trojanized repositories with fully functional e-commerce projects embedding malicious code concealed using steganography within SVG flag images. Upon running these projects, a four-stage malware payload aligned with OTTERCOOKIE is deployed, comprising a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was uncovered following attacks on Elastic's community Slack workspace. The malware's initial zero antivirus detection rate demonstrates a sophisticated supply chain attack method against software developers.

The malware can steal browser credentials and cryptocurrency wallets, exfiltrate files, provide remote access to attackers, and steal clipboard data. This compromises developer systems, potentially leading to credential theft, financial loss, data leakage, and unauthorized remote control. The supply chain nature of the attack increases risk by targeting developers who may unknowingly distribute compromised code.

No official patch or remediation is available as this is a malware campaign rather than a software vulnerability. Developers should exercise caution when accepting job offers or coding challenges from unverified sources and thoroughly vet any third-party repositories before use. Employing endpoint detection and response solutions capable of detecting steganography or multi-stage malware may help. Monitor for indicators of compromise such as the provided hashes and domains. Since this is not a cloud service, remediation depends on user vigilance and security controls.