Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean-linked threat actors (REF9403/Contagious Interview) targeted software developers via fake job postings and trojanized coding assessments that hide Base64-encoded payload fragments inside SVG image comments. A JavaScript loader reassembles the fragments into a four-stage OtterCookie-derived malware (browser and crypto wallet stealer, file stealer, Socket.IO-based RAT, clipboard stealer), enabling data exfiltration, persistent remote access, and supply-chain risk to downstream organizations.