North Korean Hackers Hijack Fake Coding Interviews with SVG Steganography to Steal Developer Credentials

North Korean‑aligned actors have launched a new Contagious Interview campaign, labeled REF9403, that uses steganography to hide malicious code inside SVG images embedded in fake coding challenge repositories.

How the attack works

Developers receive a job posting that includes a “coding challenge” project. When the repository is cloned and executed, the code quietly pulls a four‑stage payload:

• Browser credential and crypto‑wallet stealer
• File exfiltration module
• Socket.IO‑based remote‑access trojan (RAT)
• Clipboard data stealer

Each stage is delivered via Base64 fragments hidden in SVG flag images, a technique that evades detection by conventional antivirus scanners.

Why developers are the target

By compromising a single developer, attackers gain initial foothold and can pivot to downstream supply‑chain targets. The lure of a lucrative side‑job, combined with the need to load libraries and scripts, makes open‑source coding forums a fertile watering hole.

Discovery and impact

The investigation began when Elastic Security Labs noticed suspicious activity in its community Slack workspace. A user named Maxwell posted a fake e‑commerce upgrade job and directed interested developers to a trojanized repository. The malicious code was undetected by any AV vendor at the time of discovery.

“The trojanized repositories are fully functional and appear legitimate, yet they silently trigger malicious code behind the scenes.”

Takeaways for the community

• Verify the provenance of coding challenge repositories before execution.
• Inspect SVG assets for hidden Base64 payloads.
• Maintain strict access controls for developer environments.
• Stay alert for job offers that require running unfamiliar code.