Fake Coding Tests Deliver Otter Cookie-Aligned Malware Hidden in SVG Flag Images
Summary: Elastic Security Labs reported that North Korean actors tied to the Contagious Interview campaign, tracked as REF9403, hid a four-stage OtterCookie-aligned payload in Base64 fragments inside HTML comments across SVG flag images in trojanized coding-challenge repositories. The lures ran through a user named Maxwell posting a developer job in a community Slack #jobs channel in late May 2026, moving interested developers to direct messages and a coding assessment whose code executed the malware on each server boot.
Bottom line: The payload's file stealer targets AI coding tool extensions including .claude, .cursor, .gemini, .windsurf, .pearai, and .llama, so a single developer running a fake assessment exposes both credentials and the tooling your teams now build with. Elastic notes that compromising one developer can provide the initial access for supply chain attacks against downstream organizations.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026