North Korean Hackers Embed OtterCookie in SVG Flags for Fake Coding Tests
The campaign, tied to DPRK’s Contagious Interview operation, hides base‑64 fragments inside SVG flag images that look normal. When a victim runs a trojanized repository from a fake coding test, the fragments reassemble into a four‑stage OtterCookie loader stealing browser credentials, crypto wallets, files, and providing a RAT. Developers chasing job offers are now a high‑value target.