New North Korean campaign uses fake coding interviews to steal developer credentials

Elastic Security Labs discovered a DPRK-linked campaign (REF9403 / Contagious Interview) that distributes trojanized developer coding challenges containing JavaScript malware hidden via Base64 steganography in SVG flag images; the multi-stage payload (OTTERCOOKIE-like) steals browser credentials and crypto wallets, exfiltrates files, establishes a Socket.IO RAT to controller.rightwidth.dev, and includes clipboard-stealing and Windows dropper capabilities, with multiple repository hashes, C2 domains, and IPs provided as IOCs.