Overview of the Contagious Interview Evolution
Security researchers have identified a sophisticated advancement in the APT campaign known as ‘Contagious Interview.’ Historically attributed to North Korean threat actors, such as the Lazarus Group, this campaign focuses on compromising software developers through Phishing via professional networking platforms and messaging applications. According to The Hacker News, the latest iteration of this threat involves the use of steganography embedded within SVG (Scalable Vector Graphics) image files to deliver a potent infostealer aligned with the OtterCookie malware family.
The attack begins with a fraudulent recruitment process where the adversary poses as a hiring manager or technical recruiter. Once a rapport is established, the target is invited to complete a technical assessment. This assessment typically involves downloading a Node.js project from a repository or a direct link. Unlike previous versions that relied on blatant malicious dependencies, this campaign hides its primary payload within legitimate-looking assets, making detection significantly more difficult for standard EDR solutions.
Technical Analysis of SVG Steganography Techniques
The core innovation in this campaign is the use of SVG images, specifically flag icons, to host malicious code. Because SVG files are XML-based, they are often overlooked by traditional security scanners that focus on binary executables or script files. The attackers embed Base64-encoded strings within the metadata or path data of these images. When the unsuspecting developer executes the provided Node.js project—typically by running a command like npm install or npm start—a pre-install or start script triggers the extraction process.
The malware deployment follows a structured four-stage execution chain. Initially, the project script identifies and reads the malicious SVG file. It then decodes the hidden data to construct a Stage 2 loader. This loader is responsible for establishing a connection to a C2 server to download additional components. By using steganography, the attackers ensure that the initial repository appears benign, as the malicious IoC is not visible in plain text or standard file signatures.
Analyzing the Four-Stage OtterCookie Payload
The final payload, identified as OtterCookie, is a multifaceted infostealer designed for high-value targets in the fintech and blockchain sectors. Once the four-stage execution is complete, the malware performs the following actions:
- Credential Harvesting: It targets popular web browsers to extract saved passwords, cookies, and autofill data.
- Cryptocurrency Theft: It scans the system for local wallet files and browser extensions related to various blockchain platforms, attempting to exfiltrate private keys and seed phrases.
- Data Exfiltration: A dedicated file stealer component identifies documents with specific extensions (.docx, .pdf, .txt) for upload to the attacker’s infrastructure.
- System Surveillance: The malware includes screen capture capabilities to monitor the user’s desktop activity in real-time.
Lazarus Group fake coding test detection
For security teams, Lazarus Group fake coding test detection requires a shift from static file analysis to behavioral monitoring. Since the malicious activity begins within a Node.js environment, SOC analysts should monitor for unusual child processes spawned by node.exe or npm.exe. Specifically, the creation of hidden files or the execution of PowerShell commands following an npm command should be treated as high-priority alerts.
Furthermore, identifying how to detect OtterCookie malware involves inspecting outbound network traffic for connections to known malicious domains or uncommon IP addresses immediately following the download of third-party repositories. Organizations should leverage their SIEM to correlate project download events with subsequent data exfiltration attempts.
Strategic Implications for Hiring and Security
This campaign highlights the continued exploitation of the trust relationship between employers and candidates. By leveraging the technical requirements of a developer’s job—specifically the need to run and test code—the attackers bypass the Zero Trust barriers that usually protect organizational assets. The use of steganography represents a TTP shift aimed at evading automated sandboxing and static analysis tools.
Recommendations and Mitigations
To effectively combat these threats, organizations must adopt a multi-layered defense strategy focused on mitigating North Korean steganography attacks and protecting developer workflows. The following actions are recommended:
- Isolated Environments: Mandate that all external coding assignments and third-party code tests be executed within an isolated, non-persistent virtual machine or a dedicated ‘dirty’ network segment that has no access to corporate credentials or production data.
- Code Review Protocols: Implement a policy where developers must perform a cursory review of
package.jsonscripts and directory structures before executing any downloaded project. Look for obfuscated scripts or references to unexpected image files in the source code. - Network Egress Filtering: Restrict developer workstations from communicating with unauthorized external IP addresses. Use a web proxy to block newly registered domains (NRDs), which are frequently used for C2 infrastructure in these campaigns.
- Endpoint Visibility: Ensure that EDR tools are configured to log and alert on Node.js process trees, particularly those involving network connections to non-standard ports or the execution of Base64-encoded PowerShell strings.
Related: Jscrambler npm Package Backdoored with Infostealer Malware, Analysis of Cross-Platform NPM Stealer Using Discord Webhooks