North Korean state-sponsored hackers have developed a sophisticated method to infiltrate developers’ systems by embedding OTTERCOOKIE malware within SVG image files. This tactic is part of a broader campaign aimed at compromising software developers through deceptive coding tests.
The attackers initiate contact by posing as potential employers, offering job opportunities that require candidates to complete a coding assessment. Victims receive what appears to be a legitimate e-commerce project, which they are instructed to run locally. Unbeknownst to them, the project’s assets contain malicious code fragments that are reassembled and executed when the server starts.
Security researchers have identified that the malware is concealed within SVG files representing country flags, such as AE.svg and AF.svg, located in the project’s assets folder. These images contain HTML comment blocks with Base64-encoded segments of the payload, allowing the malware to evade detection during standard code reviews and security scans.
A JavaScript file named serverValidation.js is responsible for reading the SVG files, reconstructing the hidden code, and executing it. The application functions as expected, making the malicious activity difficult to detect. The concealed routine activates automatically each time the server is launched.
Once executed, the OTTERCOOKIE malware deploys several components: a browser credential and cryptocurrency wallet stealer, a file stealer, a clipboard data collector, and a remote access module utilizing Socket.IO. These tools enable attackers to harvest sensitive information and maintain control over the compromised system.
This method represents an evolution of the hackers’ previous strategies, which included distributing malicious packages and creating fake developer profiles. By embedding malware within seemingly innocuous image files, the attackers have enhanced their ability to bypass traditional security measures and exploit the trust developers place in coding assessments.
The implications of this campaign are significant. Developer environments often contain access to source code repositories, cloud services, and sensitive data. A single compromised machine can serve as a gateway to broader organizational networks, leading to data breaches and intellectual property theft.
To mitigate such risks, developers and organizations should exercise caution when receiving unsolicited coding tasks, even from seemingly reputable sources. It’s crucial to thoroughly review all components of a project before execution, paying special attention to asset directories and startup scripts. Implementing robust security practices, such as code audits and sandbox testing, can help identify and neutralize hidden threats before they cause harm.
