North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests
Do Son 
At a glance
| Actor / group | DPRK-aligned group behind the Contagious Interview campaign (Elastic tracks it as REF9403) |
| Activity type | Social-engineering job lures delivering trojanized coding projects |
| Targets / victims | Software developers on Windows, macOS, and Linux, especially in crypto and Web3 |
| Scale | Multiple trojanized repos with zero antivirus detections; some pushed to GitHub by victims |
| Status | Active; DPRK-linked; no arrests |
| Source | Elastic Security Labs |
TL;DR
Elastic Security Labs uncovered a new Contagious Interview campaign aimed at developers. Fake recruiters offer coding tests that hide malware inside SVG image files. Anyone who runs the project gets a four-part stealer linked to North Korea.
What happened
The fake job lure
The trap started in a developer Slack. A recruiter persona named “Maxwell” posted a job for an e-commerce project. Interested users moved to direct messages. There, they received a “coding challenge” repository. The project ran fine on the surface. Underneath, it carried hidden malware. Elastic says these projects “run perfectly fine, the malicious code is triggered silently behind-the-scenes.”
Malware hidden in flag images
The new trick sits in the images. The first sample copied a real Next.js store template called GoCart. That legitimate base made the trap look convincing. Attackers split the payload into Base64 chunks. Then they tucked those chunks inside SVG country-flag files. A helper script rebuilds the code and runs it at server start. As a result, the repos showed zero antivirus detections.
Who is behind it
Elastic links the activity to the DPRK-aligned Contagious Interview cluster. It tracks this wave as REF9403. The malware overlaps with OTTERCOOKIE, first documented by NTT Security in late 2024. Attribution rests on code similarity, shared behavior, and related infrastructure. So far, no individuals have been named. Still, several vendors, including Microsoft, tie the Contagious Interview operation to North Korea with medium-to-high confidence. The wider campaign has run since at least 2022, according to Palo Alto Networks.
Impact and scale
The payload does real damage. It runs across Windows, macOS, and Linux. On Windows, it hides under the name npm-cache to blend in. It steals browser credentials and crypto wallet data. It also sweeps developer files for keys, configs, and source code. A Socket.IO backdoor then grants live shell access. Meanwhile, a clipboard stealer watches for copied secrets. Notably, the file stealer skips AI coding-tool folders to cut noise. Some victims even pushed the backdoored repos to GitHub. Therefore, one careless developer can seed a wider supply-chain risk. The four modules now ship as an all-in-one package, folding stealer, RAT, and clipboard theft into a single kit.
What comes next and how to stay protected
The campaign keeps evolving, so caution matters. Never run a stranger’s code on a work or personal machine. Treat unsolicited coding tests as a red flag. Verify any recruiter through official company channels. Better yet, run take-home projects inside a throwaway virtual machine. Watch for odd outbound connections from developer hosts.
Detection tips
Inspect SVG assets for injected Base64 comment blocks. Flag scripts that reassemble and evaluate such data at runtime. Watch Node processes that spawn shells or PowerShell. Also monitor uploads to unfamiliar developer-themed domains. Elastic has published indicators and detection rules to help.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
