TLDR Tech / InfoSec
New North Korean campaign uses fake coding interviews to steal developer credentials
Elastic Security Labs tracked a Contagious Interview campaign (REF9403) in which DPRK-aligned actors posted fake job offers in developer Slack channels, moved targets to DMs, and delivered trojanized e-commerce "coding challenge" repos that reassembled Base64 payload chunks hidden in SVG flag images via steganography, then executed them with eval() on every server start. The four-stage OTTERCOOKIE-aligned payload combined a browser credential and crypto wallet stealer, a recursive file stealer, a Socket.IO RAT, and a clipboard stealer, exfiltrating to rightwidth[.]dev subdomains and IPs 195.26.248[.]212 and 188.40.64[.]61, with zero AV detections at the time of writing. Defenders should treat unsolicited take-home coding tests as hostile, run them only in isolated VMs, hunt for node.exe spawning cmd.exe/powershell.exe with Get-Clipboard, and block the listed C2 domains. MITRE techniques include T1027.003 (Steganography), Clipboard Data, and Credentials from Password Stores.
Read the full story