Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors associated with the Contagious Interview campaign are using steganography to hide malware in SVG image files. The malicious payloads are delivered through fake job postings and coding challenges. When a user runs the project, they end up with a four-stage payload that includes a browser credential and crypto wallet stealer, as well as a file stealer. This payload is aligned with OTTERCOOKIE. The attackers are leveraging this tactic to conceal their malicious activity. The use of fake coding tests is a social engineering technique to trick victims into executing the malware.