Fake Coding Interviews Used in a New North Korean Credential Theft Campaign

Summary

A DPRK-aligned threat actor is running a campaign known as Contagious Interview to target developers through fake job offers and coding tasks. The attack uses steganography inside SVG files to conceal malicious payloads that are later executed through JavaScript. Once deployed, the malware operates as a multi-stage toolkit capable of stealing browser credentials, cryptocurrency wallets, files, and enabling remote access through a Socket.IO-based RAT.

Investigation

Elastic Security Labs uncovered the campaign after identifying suspicious activity in its community Slack workspace involving fraudulent job postings. The investigation showed that the threat actors used trojanized Next.js e-commerce repositories to distribute malware. Analysis further revealed that the payloads share notable code similarity and behavioral overlap with the OTTERCOOKIE malware family.

Mitigation

Organizations should enforce strict controls over execution of untrusted third-party code and libraries within developer environments. Developers should also be trained to recognize social engineering tactics used on platforms such as Slack and GitHub. In addition, monitoring for unusual outbound connections to unfamiliar domains and deploying strong endpoint detection and response capabilities is essential.

Response

If this activity is detected, affected developer workstations should be isolated from the network immediately to prevent further exfiltration or lateral movement. Investigators should perform a full review of browser profiles, local files, and cloud credentials accessed from the compromised system. All accounts used on the host should undergo credential resets, and the developer’s recent code commits should be audited to rule out any supply chain compromise.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access to a victim workstation. To avoid manual detection and speed up the exfiltration of credentials potentially copied by the user, the attacker executes a scripted command to grab the clipboard content. To evade simple signature-based detection, they use the exact flags anticipated by many basic SOC rules: -NoProfile and -NonInteractive. The command Get-Clipboard is called to dump the contents to the console or a file for subsequent exfiltration.

• Regression Test Script:

  # Simulate the exact command the rule is looking for
  # This is designed to trigger the 'Unauthorized Clipboard Access via PowerShell' rule.
  powershell.exe -NoProfile -NonInteractive -Command "Get-Clipboard"

• Cleanup Commands:

  # No permanent artifacts are created by the simulation, 
  # but we clear the clipboard to ensure no sensitive test data remains.
  powershell.exe -Command "Set-Clipboard -Value 'CLEANUP_COMPLETE'"