New North Korean campaign uses fake coding interviews to steal developer credentials

Elastic Security Labs discovered a DPRK-aligned campaign (Contagious Interview / REF9403) that lures developers with fake job postings and coding challenges, trojanizes legitimate project repositories, and hides multi-stage malware in SVG image comments using Base64 steganography. The payloads reconstruct and execute obfuscated JavaScript to deploy OTTERCOOKIE-like functionality — exfiltrating browser credentials and crypto wallet data, stealing files, establishing a Socket.IO RAT, capturing clipboard data, and dropping Windows executables — with multiple domains, IPs, and SHA-256 IOCs provided.