A North Korean hacking group has been observed using fraudulent coding interviews to distribute malware hidden inside SVG images, a campaign that Elastic Security Labs has dubbed Contagious Interview.
The attackers embed malicious JavaScript within the SVG file using steganographic techniques, allowing the payload to evade many signature‑based antivirus scanners, as described in the analysis posted by security researchers. When opened, the SVG executes a four‑stage chain that first harvests browser credentials and cryptocurrency wallet data, then establishes a reverse shell for remote access and finally exfiltrates gathered files to attacker‑controlled servers.
The campaign is not limited to a single operating system; Windows, macOS and Linux developers have all been observed as potential victims. Fake job advertisements are posted on popular developer forums and professional networks, linking to Git‑hosted projects that appear legitimate but contain the tainted SVG in the README or source tree.
Elastic Security Labs first detected the activity on 17 July 2026 and continued to see infections through 24 July 2026, after which the infrastructure went quiet, according to the Elastic report. Although the group has not been publicly attributed to a specific North Korean unit, the tactics and reused code bear similarities to the OTTERCOOKIE malware family previously associated with DPRK actors.
Organisations should treat unsolicited coding tests with scepticism and verify the provenance of any repository before cloning or building it. Security teams can hunt for SVG files that contain unusual script tags or embedded base64 strings, and block the execution of inline JavaScript from such images at the endpoint. Network monitoring for outbound connections to newly registered domains or to IP addresses with poor reputation can help catch the exfiltration phase.
Endpoint detection and response tools should be tuned to alert on the execution of wscript or mshta processes launched from temporary directories after an SVG is opened. Developers are advised to disable automatic preview of SVG files in editors and to scan third‑party dependencies with static analysis tools that inspect image content for hidden scripts.