North Korean Contagious Interview Campaign Hides OTTERCOOKIE Malware in SVG Images

A sophisticated North Korean threat campaign dubbed “Contagious Interview” has resurfaced with new delivery techniques, leveraging weaponized SVG image files to deploy the OTTERCOOKIE malware while coinciding with a separate supply chain intrusion targeting the Ruby ecosystem.

Security researchers tracking DPRK-linked activity note that the campaign continues to impersonate recruiters and job interview workflows, luring developers into executing seemingly benign files.

The latest iteration replaces traditional document-based lures with SVG images embedded with obfuscated JavaScript, enabling stealth execution when rendered in browsers or developer tools.

This evolution significantly reduces detection rates, as SVGs are typically treated as safe graphical assets rather than executable content.

Once triggered, the SVG payload initiates a staged infection chain that ultimately deploys OTTERCOOKIE, a modular backdoor associated with North Korean intrusion sets.

The malware supports command execution, credential harvesting, and persistence, often targeting developer environments and crypto-related assets.

Analysts highlight that OTTERCOOKIE is increasingly being used in social engineering campaigns aimed at software engineers, aligning with North Korea’s broader objective of infiltrating software supply chains.

The compromised packages git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab acted as loaders designed to deploy second-stage payloads from an attacker-controlled Forgejo instance.

Notably, the git_credential_manager package impersonated Microsoft’s legitimate Git Credential Manager, with malicious versions ranging from 2.8.0 through 2.8.3.

The attack leveraged ecosystem trust by publishing directly to RubyGems without corresponding GitHub tags, a key anomaly that exposed the compromise.

StepSecurity said in a report shared with GBhackers, this activity overlaps with a newly disclosed supply chain attack named “SleeperGem,” observed between July 18 and July 19, 2026, where three malicious RubyGems packages were uploaded to RubyGems.org.

Similarly, Dendreo released versions 1.1.3 and 1.1.4 after nearly six years of inactivity, while the fastlane plugin introduced version 0.3.2 with no upstream reference.

OTTERCOOKIE Malware in SVG Images

Runtime analysis conducted using StepSecurity’s Harden-Runner revealed a carefully engineered execution chain.

The malicious gems performed environment checks against approximately 30 CI-related variables, including GITHUB_ACTIONS and GITLAB_CI, to evade detection in automated pipelines.

When executed on developer machines, the loader fetched a shell script (deploy.sh) and a native binary disguised as a legitimate tool.

The payload established persistence by installing a daemon in ~/.local/share/gcm/, alongside redundant mechanisms via systemd user services and cron jobs under the name git-credential-manager.

Further escalation logic probed for sudo privileges, with the capability to plant a setuid root shell at /usr/local/sbin/ping6 when conditions allowed.

Network telemetry confirmed communication with a Forgejo-hosted command-and-control server (git.disroot.org), with HTTP requests mimicking legitimate Git traffic through a simplified User-Agent string.

Importantly, version 2.8.2 of the malicious gem staged the payload without execution, while version 2.8.3 activated the full infection chain, indicating iterative attacker testing.

Researchers emphasize that the actual credential theft functionality resides within the deployed native daemon rather than the gem itself, complicating static detection.

The reuse of infrastructure across all three packages confirms a coordinated campaign rather than isolated incidents.

The convergence of SVG-based social engineering and supply chain compromise highlights a broader trend in North Korean operations: targeting developers as high-value entry points into enterprise and blockchain ecosystems.

The dual use of trusted platforms job portals and package registries demonstrates an advanced understanding of developer workflows and trust boundaries.

Organizations are advised to treat any system that installed the affected RubyGems packages as compromised, remove persistence artifacts, and rotate all credentials.

The incident underscores the growing need for runtime monitoring, provenance validation, and stricter controls around package publishing and dependency management.

Indicators of Compromise

Gem name	Malicious versions	Command and control host / note
git_credential_manager	2.8.0, 2.8.1, 2.8.2, 2.8.3	git.disroot.org (path impersonating an official Git ecosystem account)
Dendreo	1.1.3, 1.1.4	git.disroot.org (path impersonating an official Git ecosystem account)
fastlane-plugin-run_tests_firebase_testlab	0.3.2	git.disroot.org (path impersonating an official Git ecosystem account)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide