Back Thehackernews

Fake Coding Tests Deliver OtterCookie

Thehackernews •[email protected] (The Hacker News) • July 17, 2026

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges.

"Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE: a browser credential and crypto wallet stealer, a file stealer, a

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Hackers Use SVG Steganography in Job Scam Malware Campaign DPRK-aligned hackers have launched a campaign known as Contagious Interview, utilizing steganography to hide malware within SVG flag images. This malware targets developers through fake job postings and coding challenges, delivering a four-stage payload that includes a credential stealer, file stealer, remote access trojan, and clipboard stealer. The campaign was first identified when suspicious activity was detected in a community Slack workspace, where a user solicited developers for a project. The malware is delivered through trojanized repositories that have not been flagged by antivirus vendors. The attack emphasizes the vulnerability of developers, as compromising a single individual can lead to extensive supply chain attacks. Multiple campaigns with similar tactics have been identified, indicating a broader threat landscape. As of now, the malware remains undetected by major antivirus solutions. 4 sources 73

Extracted Entities

Fake Coding Tests Deliver OtterCookie

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (2)