🚨 DPRK Fake Job Interviews: How a Coding Test Can Become a Malware Attack

The dangerous part of this campaign is the credibility of the workflow. A victim may believe they are reviewing a normal software project, installing dependencies or completing a coding assignment for a real employer. The repository can function normally while malicious code executes in the background.

Elastic Security Labs reported a July 2026 Contagious Interview campaign in which fake recruiters used developer communities and direct messages to deliver trojanized coding projects. Elastic observed payloads hidden in SVG flag images and a four-stage payload aligned with OTTERCOOKIE.

The Australian Cyber Security Centre identifies WaterPlum, commonly referred to as Contagious Interview, as a North Korean cyber actor group targeting IT professionals. The supplied research therefore supports a high-priority developer-security warning, while the exact victim, lure and compromise path of any individual case still need case-specific validation.

1. Fake opportunity: an attractive developer role, freelance task or collaboration.

2. Trust building: conversation moves into direct messages and becomes personalized.

3. Technical assessment: the victim receives a coding challenge or repository.

4. Execution pressure: the victim is encouraged to run the project, install dependencies or open it in a development environment.

5. Silent activation: project code reconstructs a hidden payload and launches it.

6. Compromise: browser credentials, wallet data, local files and clipboard contents may be targeted, while a Socket.IO component can provide interactive access.

The sequence above follows the workflow specified in the supplied research. It is an analytical reconstruction of the documented campaign, not a claim that every stage is observed in every victim environment.

SVG is XML-based and can contain text and markup. In the observed campaign, multiple flag SVGs contained Base64 fragments inside HTML comments. A JavaScript routine read the SVGs in sorted order, extracted the comments, joined the fragments, decoded them and passed the result into execution.

The security lesson is simple: a visible image can look harmless while the same file also carries data that is operationally meaningful to the program loading it.

Elastic says the specific infection chain was newly documented by its team and that the resulting payloads shared technical and behavioral similarities with OTTERCOOKIE.

The Australian advisory also recommends disconnecting suspected devices, assuming sensitive data may already have been exfiltrated, creating a new wallet on a separate device where relevant, resetting systems, using EDR and using VS Code Restricted Mode for unknown projects.

These are public research observables, not proof that every connection is malicious. Validate them with endpoint, DNS, proxy and process telemetry before treating an observed match as an incident.

The hashes are reproduced from the supplied research document and should be treated as public research observables. Validate against your own telemetry and sample provenance before using them for incident attribution.

Elastic explicitly maps the observed activity to these techniques and related tactics. This mapping describes the public research context; it is not evidence that every technique occurred on every victim.

The best detection strategy is behavioral correlation. A single DNS hit is weaker evidence than a sequence linking a repository execution event, suspicious child process creation, credential-store access and outbound communication to infrastructure associated with the campaign.

A job interview can become an initial-access vector. DPRK-linked Contagious Interview activity shows how attackers can approach developers with convincing job offers, deliver a normal-looking coding challenge and hide malicious payloads inside SVG flag images. Once executed, the chain can target browser credentials, crypto wallets, local files and clipboard data while establishing remote access. A coding challenge is still executable code—verify it before you run it.