Contagious Interview the SVG trick with Base64 that steals credentials and exposes the supply chain

A new chapter of the long campaign attributed to North Korean actors - identified by Elastic Security Labs as part of the operation known as Contagious Interview and further categorized as REF9403 - reveals a disturbing combination of social engineering aimed at developers and evasive malware techniques: steganography embedded in SVG files that camouflages payload fragments in Base64 reviews, assembled by legitimate JavaScript code in threaded repositories that are offered as technical tests for use.

The trick takes advantage of the trust of the technical community: job offers and coding challenges published on channels such as Slack induce stakeholders to clone and run projects that seem to work properly in the first instance. Behind that apparent operation is a four-stage chain similar to malware known as OtterCookie: browser credentials and cryptomoneda portfolios, file exfiltration, a persistent backdoor based on Socket.IO and clipboard theft. In addition, the code seeks extensions and devices related to IA tools, suggesting a clear interest in sensitive and key data that facilitate access to valuable environments and resources.

From the technical point of view, the use of SVG with comments containing Base64 fragments distributed among multiple images is a deliberate attempt to evade scanners and static signature: asset files seem harmless (e.g. AE.svg, AF.svg), but contain commented blocks that the repository validation script concatene and decodify in running time. The payload is programmed to run even in server boot, which transforms a simple technical test into a persistent input door with control and control capabilities.

The implications are clear and broad: a single committed developer can become a vector of a supply chain attack, inserting malicious code into shared projects, dependencies or CI / CD pipelines. In addition, the combination of portfolio and credentials theft amplifies immediate economic damage and facilitates exfiltration campaigns that are difficult to reassemble if the keys are reused or not rotated quickly.

In terms of detection and attribution, the technique complicates visibility because the signals spread between static resources (images), seemingly legitimate artifacts and functional code. This reinforces the need to complement signatures with behavior analysis, file integrity monitoring and strict execution control in productive environments. For context and taxonomy of techniques, it is useful to consult reference repositories such as MITRE ATT & CK ( https: / / attack.mitre.org /) and sectoral analyses published by response groups such as Elastic Security Labs ( https: / / www.elastic.co /), which describe how these campaigns are evolving.

For individual teams and developers, practical measures begin with the basic principle of not running external code with unnecessary privileges: isolate evidence in ephemeral environments without access to secrets, disable automatic executions by clone repositories and review static assets for suspicious comments or Base64 blocks.

Complementing individual hygiene with organizational policies reduces the risk: forcing the review of pull requests, scanning repositories for unusual secrets and artifacts before integrating them into pipelines, blocking unauthorized outgoing connections from CI runners and applying integrity controls on servers that start new services. Also, adopting the principle of minor privilege in browser extensions and portfolios, and segregating access keys and wallets (for example using hardware wallets or limited accounts), limits the impact in case of information leakage.

Detection solutions should include network telemetry aimed at identifying unusual Socket.IO connections, EDR rules that detect the decoding and execution of memory-assembled blobs, and alerts on processes that try to read the clipboard or access browser key stores. The immediate rotation of exposed credentials and the revocation of committed tokens are essential actions after an incident.

Finally, this incident shows that software security is not just a matter of public dependencies or malicious npm packages: the human vector remains the most fragile link. Training technical communities to identify false employment lures, promote scepticism in the execution of code received through social channels and promote device validation practices will be as necessary as automatic tools to mitigate the risk of sophisticated campaigns such as Contagious Interview.