North Korea buried four-stage malware in flag images: Zero antivirus detections

North Korea's Contagious Interview hackers have spent years posing as recruiters to trick developers into running malware — but the technique disclosed today by Elastic Security Labs is different in a way that matters to every developer who has ever accepted a coding challenge from a stranger online. The attackers hid their payload inside the HTML comment blocks of SVG country flag image files, fragmenting the malicious code across dozens of innocuous-looking images of national flags, then reassembled and executed it automatically on every server start. At the time Elastic published its findings, not a single antivirus engine had flagged any of the trojanized repositories. That is not a near-miss. It is a structural gap: antivirus tools designed to detect pixel-level image manipulation have no mechanism to parse the semantic content of SVG comment blocks, and North Korea's operators knew it.

The campaign, tracked internally by Elastic as REF9403, is the latest development in the long-running Contagious Interview operation, which CrowdStrike documented last month as responsible for 47% of all state-sponsored interactive intrusions against the tech sector during the 12 months ending March 2026. Elastic discovered REF9403 not through customer telemetry but because the threat actors targeted Elastic's own community Slack workspace with a fake job offer in late May 2026.

A Fake Job Offer That Targeted Elastic's Own Developers

On May 26, 2026, a user named "Maxwell" posted in Elastic's #jobs Slack channel, claiming to be upgrading an e-commerce platform and seeking a developer skilled in Next.js, NestJS, PostgreSQL, and Auth.js. Users who responded were moved into direct messages and handed a trojanized GitHub repository disguised as a coding challenge.

The repository was not a hollow shell. It was a fully functional e-commerce project cloned from a legitimate open-source template called GoCart, originally published by GreatStackDev on GitHub — indistinguishable from the kind of project a real prospective employer might send. The threat actors inserted small snippets of malicious code at strategic points, using benign variable names to obscure their intent.

Building on the Maxwell case, Elastic researchers identified a cluster of related trojanized repositories — including next-ecommerce-private-main.zip, shopping-platform-main.zip, ecommerce-platform.zip, and four additional variants — all exhibiting the same underlying technique. Every one had zero antivirus detections at the time Elastic published its report. Elastic noted it found no evidence that the lures were targeted specifically at Elastic employees: any developer community forum is a potential target.

Why Antivirus Missed It: SVG Comment-Block Steganography

The zero-detection result was not coincidental. It was architectural.

Conventional antivirus tools that evaluate image-based steganography look for statistical anomalies in pixel data — modifications to the least significant bits of color values, for instance, that indicate hidden information has been embedded in visual content. The REF9403 technique does not touch pixel data at all. Instead, the malicious payload was split into Base64-encoded fragments and injected into HTML comment blocks — the syntax — distributed across every SVG country-flag image in the project's assets/flags/ directory. Files named AE.svg, AF.svg, and so on appeared completely normal when rendered; each simply contained an injected comment block carrying a fragment of encoded data invisible to any tool that renders or pixel-scans the image without parsing comment content.

A JavaScript file in the repository — serverValidation.js — reconstructed the payload by reading all SVG files in alphabetical order, extracting the comment content from each, and concatenating the fragments into a complete Base64 string. That string was then decoded using a custom function called Check(), deliberately chosen to avoid Buffer.from() and atob() — two standard JavaScript decoding methods that security tools are more likely to flag. The reconstituted payload was then executed via eval().

The malware protected itself further with obfuscator.io, a commercial JavaScript obfuscation service that uses string array extraction with index-based lookups, a self-rotating anti-tampering array, and other techniques to defeat static code analysis.

The function ran automatically each time the server started, because server/index.js called runServerValidation() after its initial middleware setup — and the project's package.json configured both npm run dev and npm start to launch server/index.js. Any developer who simply started the project to evaluate it was immediately compromised. To Elastic's knowledge, this specific infection chain had not been previously documented in Contagious Interview's history.

What the Malware Does in Four Stages

Once the payload executed, it deployed four modules in parallel, all masquerading as npm-cache processes to blend into developer task managers.

Stage 1 — Browser Credential and Cryptocurrency Wallet Stealer: The first module identified the operating system at runtime and targeted the saved credential databases, autofill data, and local extension storage of Chrome, Edge, Brave, and Opera across Windows, macOS, and Linux. It held a hard-coded list of 25 targeted browser extensions — led by MetaMask, Rabby, Phantom, Keplr, and Trust Wallet — with a prioritization system that retried exfiltration of the top eight wallets until the C2 server acknowledged receipt. On macOS, it additionally exfiltrated the system keychain database. All credential data was posted to ldb.rightwidth[.]dev.

Stage 2 — File Stealer: The second module recursively swept the victim's filesystem targeting files matching patterns including .env*, .pem, .json, .ts, .js, .pdf, .docx, .xlsx, AWS and Azure credential directories, SSH keys, and shell history files. On Windows, the sweep covered all mounted drives; on macOS and Linux, it was limited to home directories. Files were posted unencrypted to upload.rightwidth[.]dev. The malware's exclusion list showed deliberate scoping: it explicitly skipped directories associated with AI coding tools including .claude, .cursor, .gemini, and .windsurf, confirming that the operators are current with the developer tooling landscape.

Stage 3 — Socket.IO Remote Access Trojan: The third stage established a persistent, encrypted command-and-control channel to controller.rightwidth[.]dev over HTTPS, using the Socket.IO library. The RAT enforced a PID lock to prevent multiple instances, included sandbox and virtual-machine detection for all three operating systems — flagging suspected analysis environments in C2 responses without halting execution, likely to help operators filter out security researchers — and allowed operators to issue arbitrary shell commands and receive real-time output. This is not a one-time credential theft: it is persistent, interactive access to the victim's machine.

Stage 4 — Clipboard Monitor and Windows Dropper: The fourth stage polled the victim's clipboard every 500 milliseconds, exfiltrating any new content to the C2 server — a capability targeted at developers who might copy API keys, seed phrases, or private keys during normal work. On Windows only, the module also downloaded three additional binaries from file.rightwidth[.]dev, disguised as .txt files, which were renamed to .exe and executed. The C2 server serving those second-stage binaries was offline during Elastic's analysis, so their contents could not be retrieved.

Why This Is Attributed to North Korea's Contagious Interview

Elastic's attribution rests on multiple independent technical indicators. The main JavaScript payload shares code similarity with OTTERCOOKIE, a malware family first documented by NTT Security Holdings in December 2024 and tracked through four successive versions by May 2025. Matching strings, behavioral patterns, and script layout align with prior Contagious Interview reporting from Microsoft. The observed API endpoints — /api/service/makelog, /api/service/process/, /cldbs, /upload — match infrastructure recently linked to the same cluster by JFrog Security researchers.

Contagious Interview was first publicly documented by Palo Alto Networks Unit 42 in late 2023, and is tracked under aliases including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, and UNC5342. It is broadly understood to be a financially-motivated subset of North Korea's Lazarus Group, operating under the Reconnaissance General Bureau with the objective of generating hard currency through cryptocurrency theft — revenue that U.S. agencies have linked to DPRK's weapons programs.

The scale of the broader campaign makes clear this is not an isolated threat. Between January 2025 and April 2026, Socket researchers tracked more than 1,700 malicious packages linked to Contagious Interview activity across npm, PyPI, Go modules, crates.io, and Packagist. CrowdStrike's most recent annual report found that Famous Chollima — the name it uses for this cluster — accounted for 47% of all state-sponsored interactive intrusions against the tech sector during the 12 months ending March 2026.

Contagious Interview's Escalating Supply Chain Threat

REF9403's social-engineering approach — the Maxwell persona, the Slack channel, the fake job offer — is the human layer of an operation that has simultaneously automated its technical delivery across the open-source ecosystem.

A related Contagious Interview sub-campaign called PolinRider, active since December 2025, took a different route: compromising legitimate package maintainer accounts, rewriting Git history to make malicious changes appear older, and distributing infected package versions across npm, Packagist, Go modules, and Chrome extensions. By April 11, 2026, PolinRider had compromised 1,951 public GitHub repositories belonging to 1,047 unique owners. In late June and early July 2026, it expanded to 108 unique malicious packages and browser extensions across four ecosystems.

What both REF9403 and PolinRider demonstrate is that Contagious Interview has become genuinely multi-modal. The social-engineering layer — fake job offers, fake recruiters, fake Slack personas — still exists, and it is effective precisely because developer communities are designed to be open and collaborative. But the campaign no longer depends on that layer alone. A developer who never responds to unsolicited job offers can still be reached through a routine npm install or a dependency update from a compromised trusted maintainer.

Elastic's report puts the structural stakes plainly: compromising a single developer can provide the initial foothold needed to enable far-reaching supply chain attacks against every downstream organization that developer serves. The individual is the entry point; the supply chain is the target.

What Developers and Security Teams Should Do Now

Elastic published detection rules, MITRE ATT&CK technique mappings, and a full list of SHA-256 hashes for all seven confirmed trojanized repositories in its July 18 report.

For developers:

Never run a repository that arrived via an unsolicited direct message or job offer — whether on Slack, Discord, LinkedIn, or any other platform — without first conducting a full manual audit of the codebase, including asset directories and server-side scripts. Pay particular attention to any calls to eval() or dynamic code execution, and to server startup files that load external assets.

If you have already run any project delivered via an unsolicited job offer, audit that project now. Check for the seven repository names identified by Elastic (including next-ecommerce-private-main.zip and shopping-platform-main.zip) and look for a serverValidation.js file or any function that reads SVG assets and reassembles Base64 content.

Block or monitor the rightwidth[.]dev domain cluster at your network perimeter. The confirmed C2 subdomains are ldb.rightwidth[.]dev, upload.rightwidth[.]dev, controller.rightwidth[.]dev, and file.rightwidth[.]dev.

Review browser-saved credentials and cryptocurrency wallet extensions if you have run any suspicious project recently. Rotate all API keys, SSH keys, cloud credentials, npm tokens, and wallet seed phrases for any machine that may have been exposed.

For security and platform teams: consider restricting eval() usage in server-side JavaScript via linting rules enforced in CI/CD pipelines. Because REF9403's payload executed at server start rather than at install time, npm v12's install-script blocking defaults — which shipped on July 8, 2026 — would not have stopped this attack. Static asset directories deserve the same scrutiny as JavaScript source files.

Frequently Asked Questions

Why didn't antivirus software catch the malware in these repositories?

Because the payload was not hidden inside image pixel data — where antivirus tools that detect steganography are designed to look — but inside HTML comment blocks within SVG files. SVG is a text-based image format, and its comment syntax () is entirely legal. Antivirus tools that render or pixel-scan an SVG file have no mechanism to extract and analyze the semantic content of comment blocks. The fragments stored in those comments looked like meaningless text to any scanner that did not specifically parse comment content, search for Base64-encoded strings inside it, and decode them. This is why zero vendors flagged the repositories: the evasion was not luck, it was an architectural choice targeting a known gap in how security tools evaluate SVG files.

How can I tell if I ran one of the malicious repositories from this campaign?

Check your project directories and download history for any of the seven confirmed repository filenames: next-ecommerce-private-main.zip, shopping-platform-main.zip, ecommerce-platform.zip, ecommerce-platform-main.zip, shopping-platform.rar, shop-main.zip, or ecommerce-main.zip. Also look for a file named serverValidation.js in the server directory of any e-commerce project you received via a job offer or direct message. If any of these match, treat the machine as compromised: rotate all credentials — npm tokens, GitHub tokens, cloud provider keys (AWS, Azure, GCP), SSH keys, and cryptocurrency wallet seed phrases — before taking any other action. Check your browser's saved credentials and examine whether any cryptocurrency wallet extensions have been accessed. Report the incident to your organization's security team and, if applicable, to CISA at https://www.cisa.gov/report.

What is the Contagious Interview campaign, and who is behind it?

Contagious Interview is a North Korean state-sponsored cyberattack operation that has been targeting software developers since at least December 2022. It is broadly attributed to a financially-motivated cluster within North Korea's Lazarus Group — operating under the Reconnaissance General Bureau — and is tracked under multiple aliases including Famous Chollima, DEV#POPPER, DeceptiveDevelopment, UNC5342, and Void Dokkaebi. The operation's primary financial objective is cryptocurrency theft to generate hard currency for the North Korean regime. It was first publicly documented by Palo Alto Networks Unit 42 in late 2023 and has since been tracked by Socket, Microsoft, JFrog, Proofpoint, Trend Micro, Elastic, and SANS, among others. As of April 2026, researchers had linked more than 1,700 malicious packages across five open-source ecosystems to this operation.

Does running npm v12 protect against this type of attack?

Not against REF9403 specifically. npm v12, which shipped on July 8, 2026, blocks postinstall and other lifecycle scripts from executing by default — a significant security improvement that would have stopped earlier Contagious Interview techniques that relied on install-time hooks. REF9403's payload fires differently: it executes when the developer runs the server with npm run dev or npm start, not during the npm install step. That means npm v12's script-blocking defaults do not interrupt this attack. The effective defenses against REF9403 are manual code review of server-side scripts and asset directories before running any project from an untrusted source, network-level blocking of the rightwidth[.]dev domain cluster, and linting rules that flag eval() usage in server-side JavaScript.