North Korean Recruitment Campaign Deploys Malware Through Fake Coding Assessments

Key Findings

• DPRK-aligned group REF9403 running active social engineering campaign targeting software developers with trojanized coding projects
• Malware payload hidden in SVG image files within legitimate-looking coding repositories, evading antivirus detection
• Four-part stealer modules collect browser credentials, crypto wallets, developer keys, and grant remote shell access across Windows, macOS, and Linux
• Campaign active since at least 2022; some victims unknowingly pushed backdoored repos to GitHub, creating supply-chain risk
• Fake recruiters use Slack and direct messaging to deliver coding challenges that execute malware silently at runtime

Background

The Contagious Interview campaign has operated for years, but researchers at Elastic Security Labs recently exposed a new wave tracked as REF9403. This effort targets software developers through social engineering, particularly those working in cryptocurrency and Web3 sectors. Multiple vendors including Microsoft link the operation to North Korea with medium-to-high confidence based on code similarity, shared behavior, and related infrastructure. The campaign represents an evolution in how attackers blur the line between legitimate development work and malware delivery.

The Attack Method

Attackers create fake recruiter personas like "Maxwell" who post job opportunities in developer Slack communities. Interested candidates get moved to direct messages where they receive a GitHub repository with a coding challenge. The trap works because the project functions normally on the surface. Developers can run it, test it, and see legitimate output. The malicious code executes silently in the background, completely invisible to the person running the project.

Technical Innovation

The real sophistication lies in the payload delivery mechanism. Attackers split malicious code into Base64-encoded chunks and embed them inside SVG country-flag image files within the project. A helper script automatically rebuilds and executes this code when the server starts. Because antivirus engines typically don't scrutinize image files for executable code, the trojanized repositories showed zero detections across major security platforms. Even when the malware ran, it left minimal forensic traces.

What the Malware Does

The payload is a four-part stealer kit that operates across all major operating systems. On Windows, it disguises itself as "npm-cache" to blend in with normal development processes. The modules handle different theft objectives: one harvests browser credentials and cryptocurrency wallet data, another sweeps developer machines for private keys, configuration files, and source code. A Socket.IO backdoor provides attackers with live shell access, while a clipboard monitor watches for copied secrets and exfiltrates them. Interestingly, the file stealer deliberately avoids AI coding-tool folders to reduce noise and avoid suspicion.

Supply Chain Risk

The threat extends beyond individual compromised developers. Several victims unwittingly pushed the backdoored repositories to GitHub, where they could infect others who forked or cloned the code. A single careless developer accepting a malicious coding test can become a vector for broader supply-chain compromise, potentially affecting entire development teams or organizations.

Detection and Prevention

Organizations should treat unsolicited coding tests from recruiters as automatic red flags. Always verify any recruiter through official company channels before engaging. The safest approach involves running take-home coding projects inside throwaway virtual machines rather than on primary work machines. Monitor for suspicious outbound connections from developer workstations, particularly to unfamiliar developer-themed domains. Technical teams should inspect SVG assets for injected Base64 comment blocks and flag scripts that dynamically reassemble and evaluate such data at runtime. Watch for Node processes spawning shells or PowerShell unexpectedly. Elastic Security Labs has published indicators of compromise and detection rules to help organizations identify this threat.

Sources

• https://securityonline.info/contagious-interview-svg-malware/
• https://www.linkedin.com/posts/dlross_north-korean-contagious-interview-campaign-activity-7486529402319757312-0WBa
• https://www.instagram.com/reel/DbCniEIiU39