Contagious Interview

North Korean threat actors linked to the Contagious Interview campaign are using steganography in SVG image files to hide malicious payloads. These payloads, part of a fake job posting and coding challenge campaign, deliver a four-stage OTTERCOOKIE-aligned malware that steals browser credentials, crypto wallets, and files.

North Korean threat actors have published 108 malicious packages and web browser extensions across npm, Packagist, Go, and Google Chrome as part of the PolinRider campaign. The campaign remains active, with new malicious packages likely to continue appearing.