Elastic Security LabsPublished
New North Korean campaign uses fake coding interviews to steal developer credentials
By Daniel Stepanic
Excerpt
Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography. To our knowledge, this specific infection chain has not been previously documented. We found it after the DPRK-aligned group targeted our own community Slack workspace with a fake job posting and a "coding challenge" project.
Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a Socket.IO-based re…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt
More from Elastic Security Labs7
- Auditing the auditor: Unmasking Apex AcceleratorElastic Security Labs · Published 12 Oct
- Phantom in the vault: Obsidian abused to deliver PhantomPulse RATElastic Security Labs · Published 14 Apr
- Credential harvesting that survives takedowns: REVSTEALERElastic Security Labs · Published 2 Sep
- Shedding light on the ABYSSWORKER driverElastic Security Labs · Published 20 Mar 2025
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
