North Korean Job-Interview Scam Hides Malware Inside Flag Images

Key points

• Researchers tied the campaign to North Korea's long-running Contagious Interview operation, which uses fake job offers to lure software developers.
• Victims who ran the supplied coding project received a four-stage payload aligned with OtterCookie, a known North Korean malware family.
• Payload code was concealed inside SVG image files using steganography, a technique that hides data inside ordinary-looking pictures.
• The final stages steal browser passwords and cryptocurrency wallet credentials, then sweep the victim's machine for files worth exfiltrating.

North Korean hackers are back with a familiar trick and a new hiding place.

Security researchers have flagged a fresh wave of the Contagious Interview campaign, a long-running operation in which people posing as recruiters approach software developers with fake job offers and coding challenges. The trap is the take-home test. Run the sample project and you infect your own machine.

First reported by The Hacker News, the criminals concealed their malware inside SVG files. SVG stands for Scalable Vector Graphics, a common image format used across the web. They buried malicious code inside a national flag image bundled with the coding test, a technique called steganography. Anyone who ran the project triggered a chain of four separate malware stages.

This isn't the only avenue Contagious Interview has used lately. Our 4 July story on North Korean hackers flooding open-source repositories with 108 booby-trapped packages showed the same crew seeding npm and other package managers with developer-targeted malware, making this the third Contagious Interview campaign we've reported since June.

What does the malware actually do?

It empties your browser and your crypto wallet, then rifles through your files.

The payload is aligned with OtterCookie, a malware family previously tied to North Korean operators. Stages one and two set up the infection quietly. The later stages do the damage: one component scrapes saved passwords and cookies from web browsers and pulls credentials from cryptocurrency wallet apps. Another sweeps the machine for useful files and sends them back to the attackers.

For a developer, that can mean stolen source code, a drained wallet, and exposed API keys inside an afternoon.

Who is being targeted?

Software engineers are the consistent target, particularly those in cryptocurrency and blockchain projects.

Outreach arrives through LinkedIn or a freelance job site. A recruiter with a plausible profile pitches a role and asks the candidate to complete a coding exercise hosted on GitHub or a shared drive. The project looks legitimate; the malicious code sits inside an image file it loads at runtime. North Korean groups have run versions of this playbook since at least 2022, and Pyongyang has been repeatedly documented by the United Nations using stolen cryptocurrency to fund state programmes.

What should developers do right now?

Treat every unsolicited coding test as suspect until proven otherwise.

If a recruiter you've never met asks you to run code on your personal or work machine, that's the moment to slow down. Run unknown projects inside a virtual machine or a disposable container, never on your daily driver. Keep cryptocurrency wallets on a separate device, ideally a hardware wallet. If you've already run something that felt off, rotate your passwords, revoke your browser sessions, and move any crypto holdings to a fresh wallet from a clean machine.

Companies hiring engineers should also warn candidates that legitimate technical interviews don't require running arbitrary code locally. Sandboxed platforms exist for a reason.

Steganography inside SVGs isn't a technique Contagious Interview invented for this campaign. We covered Ousaban using the same hiding method against banking customers on 1 July. What's notable here is that two separate threat actors adopted it within weeks of each other. Watch for the technique to spread.