Contagious Interview Campaign Delivering OtterCookie Malware via SVG Steganography
First seen Jul 19, 2026 · Updated Jul 19, 2026
North Korean threat actors behind the Contagious Interview campaign are using fake coding tests and job postings to lure developers into running malicious projects. The payloads are hidden via steganography in SVG flag images, ultimately deploying a four-stage OtterCookie-aligned malware chain that steals browser credentials, crypto wallets, and files.
Technical Analysis
The attackers distribute trojanized coding challenge or interview projects that embed malicious payloads inside SVG image files using steganographic techniques, evading static analysis and email/web content filters. Once executed, the malware deploys in four stages aligned with the OtterCookie family: an initial loader, a browser credential and cryptocurrency wallet stealer, a file stealer, and an additional payload stage (details on the fourth stage were truncated in source reporting). This targets developers and engineers, a population increasingly likely to have local development environments configured with API keys, cloud credentials, and AI coding assistant/agent integrations, meaning stolen credentials could expose LLM API keys, agent orchestration tokens, and connected repository or cloud access used by AI-assisted development pipelines. Given the campaign's focus on software engineers who often test or build AI-integrated tooling, successful compromise could provide attackers a foothold to pivot into CI/CD systems and agent-connected infrastructure.
Affected Systems
Developer workstations (Windows/macOS/Linux) used for coding interviews or take-home projects; Node.js/JavaScript and Python developer environments; browsers with stored credentials; cryptocurrency wallet applications; local files containing SSH keys, cloud credentials, or API tokens
Indicators of Compromise
- Malicious SVG files containing embedded steganographic payloads (specific hashes not disclosed in source)
- Fake job posting / coding challenge repositories (specific URLs not disclosed in source)
- OtterCookie-family payload artifacts (four-stage deployment chain)
- C2 infrastructure associated with Contagious Interview campaign (not disclosed in source)
Remediation Steps
- 1
Vet coding challenge sources
Treat unsolicited job offers and coding tests requiring project execution as high-risk; verify recruiter identity and legitimacy through official company channels before running any provided code.
- 2
Sandbox untrusted code execution
Run any third-party coding test, take-home project, or downloaded repository in an isolated VM or ephemeral container with no access to production credentials, cloud tokens, or crypto wallets.
- 3
Rotate and scope credentials
Immediately rotate browser-stored credentials, API keys (including LLM/agent service keys), cloud provider tokens, and crypto wallet keys if a suspicious project was executed.
- 4
Inspect SVG and image files for embedded payloads
Deploy content inspection tooling capable of detecting steganographic payloads in SVG/image files at email gateways and endpoint scanners.
- 5
Restrict developer environment credential exposure
Enforce least-privilege scoping and short-lived tokens for developer machines that interact with AI coding agents, CI/CD, and repository access to limit blast radius of credential theft.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.