North Korean-linked hackers are hiding OTTERCOOKIE-aligned malware inside ordinary SVG flag images, turning a familiar part of a web project into a concealed delivery channel.

The operation targets software developers who believe they are completing a coding test for a job opportunity.

The victims receive a working e-commerce project through social-engineering messages, then are asked to run it locally.

Although the application appears legitimate, its assets contain fragments of malicious code that are quietly rebuilt when the server starts.

StepSecurity analysts have noted the growing danger of developer-focused attacks that hide harmful behavior until code is executed.

In this case, Elastic Security Labs and StepSecurity said in a report shared with Cyber Security News (CSN) that the activity is tracked as REF9403 and is linked to the long-running Contagious Interview operation.

The impact can be severe because developer machines often hold browser sessions, source-code access, cloud keys, and cryptocurrency wallets.

Dendreo repository (Source - StepSecurity) — Dendreo repository (Source – StepSecurity)

A single test project can therefore give attackers a route to valuable personal and corporate data without exploiting a software flaw.

North Korean Hackers Hide OTTERCOOKIE Malware

The attackers used SVG files depicting country flags, including AE.svg and AF.svg, in the project’s assets folder.

Each image looked harmless, but HTML comment blocks held Base64-encoded pieces of the payload, allowing the malware to avoid obvious inspection and security scanning.

A JavaScript file named serverValidation.js reads the SVG files, joins the fragments, and executes the recovered code.

The project remains functional, which makes the trap harder to spot, while the hidden routine runs automatically whenever the server boots.

Fastlane plugin repository (Source - StepSecurity) — Fastlane plugin repository (Source – StepSecurity)

The recovered toolkit has four main parts: a browser credential and cryptocurrency-wallet stealer, a file stealer, a clipboard collector, and a remote-access component using Socket.IO.

Together, they can collect sensitive information and give an operator a way to run commands on an infected system.

This approach expands on the group’s familiar fake-interview playbook, which has also used malicious packages and fabricated developer portfolios.

Readers tracking North Korean npm campaign activity can see how the same broader focus on developers has moved across repositories, package registries, and hosting services.

Fake Tests Raise Risk

The campaign reportedly began with job messages posted in a community Slack channel, followed by direct contact and a request to finish a coding assessment.

This routine recruitment-style interaction is important because it gives the project a credible reason to be downloaded and executed.

Organizations should treat unsolicited coding tasks as untrusted software, even when their code looks polished and the application works as promised.

Before running one, developers should review server startup files and asset directories, and look closely for dynamic code execution such as eval() or code that reads image files.

Teams that have run a suspect project should isolate the device, review browser-stored credentials and wallet extensions, and rotate exposed API keys, SSH keys, cloud credentials, GitHub and npm tokens.

This is especially important given OTTERCOOKIE credential theft features, which include cross-platform collection capabilities.

Network defenders should monitor or restrict connections to the identified rightwidth[.]dev infrastructure rather than relying only on install-script controls.

The payload starts at server launch, so package-manager protections aimed at installation scripts may not stop it; malicious package supply-chain threats also show why dependency and repository review must extend beyond initial installation.

Security teams can add checks that flag eval() in server-side JavaScript and inspect SVG comments for unusual encoded content.

They should also search project folders and download histories for the known archive names and serverValidation.js, then preserve evidence before rebuilding systems where the scope of exposure is unclear.

The incident is another reminder that image files and other static assets are not automatically safe.

Developers should verify the sender, inspect every part of an assessment repository, and avoid executing code from a job offer until it has been independently reviewed, particularly amid developer credential theft campaigns.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
File name	`AE.svg`	SVG country-flag asset used to hold Base64-encoded payload fragments
File name	`AF.svg`	SVG country-flag asset used to hold Base64-encoded payload fragments
File name	`serverValidation.js`	JavaScript file that reconstructs and executes the hidden payload
File name	`next-ecommerce-private-main.zip`	Identified malicious project archive
File name	`shopping-platform-main.zip`	Identified malicious project archive
File name	`ecommerce-platform.zip`	Identified malicious project archive
File name	`ecommerce-platform-main.zip`	Identified malicious project archive
File name	`shopping-platform.rar`	Identified malicious project archive
File name	`shop-main.zip`	Identified malicious project archive
File name	`ecommerce-main.zip`	Identified malicious project archive
Domain	`rightwidth[.]dev`	Malicious infrastructure cluster associated with the campaign
Domain	`ldb.rightwidth[.]dev`	Confirmed command-and-control subdomain
Domain	`upload.rightwidth[.]dev`	Confirmed command-and-control subdomain
Domain	`controller.rightwidth[.]dev`	Confirmed command-and-control subdomain
Domain	`file.rightwidth[.]dev`	Confirmed command-and-control subdomain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers appeared first on Cyber Security News.