SVG steganography turns developer coding challenges into malware delivery
Elastic Security Labs uncovered a DPRK‑aligned campaign that lures developers into running fake coding‑challenge repos. The repos hide a four‑stage payload—credential stealer, file thief, Socket.IO RAT, and clipboard hijacker—inside SVG files using steganography. Compromising a single developer can jump‑start supply‑chain attacks on downstream projects.