Beware Fake Coding Tests: SVG Images Hide OtterCookie Malware

Robert Moore · 2026-07-17

If you're a developer looking for your next job, you might think a coding challenge is just part of the process. But a new wave of attacks from North Korean threat actors is turning those tests into a trap. Here's what's happening and how to protect yourself. ### The Contagious Interview Campaign Security researchers have linked these attacks to the Contagious Interview campaign, a long-running operation that uses fake job postings to lure in victims. The latest twist? Steganography hidden in SVG image files. These aren't your typical image files—they're vectors that can carry code alongside visual data. "Any user who ran the project ended up with a four-stage payload aligned with OTTERCOOKIE," researchers noted. That payload includes: - A browser credential stealer - A crypto wallet stealer - A file stealer This isn't just a simple virus. It's a multi-stage attack designed to strip you of your digital identity and assets. ### How the Attack Works The process starts innocently enough. You apply for a job, get a coding challenge, and download a project to work on. But hidden inside an SVG file—often disguised as a flag image—is the malicious code. When you run the project, the payload activates in four stages, each designed to evade detection. Think of it like a Russian nesting doll. The first stage might look harmless, but it unpacks the next, and so on, until the real malware—OtterCookie—is loose on your system. This malware specifically targets browsers and crypto wallets, making it a nightmare for anyone who handles digital currencies or sensitive accounts. ### Why Developers Are at Risk Developers are prime targets because they're used to downloading and running code from strangers. Job applications often require sharing projects or running tests. Attackers exploit this trust, hiding malware in what looks like a normal part of the process. > "The attackers are banking on your professionalism. They know you'll follow instructions, so they make the instructions the trap." If you're a developer, this is a wake-up call. Your next coding test could be a weapon. ### Protecting Yourself Here are some practical steps to stay safe: - Verify job postings through official company websites, not just emails - Run coding challenges in isolated environments, like virtual machines - Inspect SVG files for unusual code before executing them - Use security tools that scan for steganography Don't assume every job offer is legitimate. The stakes are high—your browser history, passwords, and crypto wallets could be stolen in minutes. ### The Bigger Picture This attack is part of a larger trend. North Korean threat actors have been increasingly using fake job offers to target tech professionals. The Contagious Interview campaign is just one example, but it shows how creative these attackers are getting. Steganography isn't new, but using it in SVG files is a clever evolution. Most people don't think to check image files for hidden code. By combining social engineering with technical deception, these attackers are raising the bar. ### What to Do If You're Targeted If you think you've already run a suspicious coding challenge, act fast: - Disconnect from the internet immediately - Scan your system with updated antivirus software - Change passwords for all accounts, especially crypto wallets - Monitor your accounts for unusual activity Time is critical. The faster you respond, the less damage OtterCookie can do. ### Final Thoughts The threat is real, but you don't have to be a victim. Stay skeptical of unsolicited job offers, and always verify before running any code. Your career depends on your skills—not on falling for a trap. Stay safe out there, and remember: if a coding challenge seems too good to be true, it probably is.