12 minhigh
New North Korean campaign uses fake coding interviews to steal developer credentials
Elastic Security Labs discovered a new Contagious Interview campaign (REF9403) attributed to DPRK-aligned threat actors that uses fake coding challenges to deliver malware hidden via SVG steganography. The trojanized repositories contain a four-stage JavaScript payload aligned with OTTERCOOKIE, combining browser credential/crypto wallet theft, file exfiltration, a Socket.IO RAT, and clipboard stealing. The malware uses obfuscator.io for code protection, custom Base64 decoding to evade detection, and masquerades as npm-cache processes while exfiltrating data to rightwidth.dev C2 infrastructure.
Sens:■ Immediate
Showing defanged values
- domaincontroller[.]rightwidth[.]devC2 subdomain for Socket.IO-based RAT — establishes persistent command-and-control channel over HTTPS using /api/service/process/<uid> and /api/service/makelog endpoints
- domainfile[.]rightwidth[.]devC2 subdomain hosting Windows second-stage payloads — dropper downloads .txt files renamed to .exe (hostService.exe, printSvc.exe, dhcpSvc.exe)
- domainldb[.]rightwidth[.]devC2 subdomain for browser credential and crypto wallet stealer module — receives stolen data via /upload and /cldbs endpoints
- domainrightwidth[.]devPrimary C2 domain for OTTERCOOKIE malware — used for clipboard data exfiltration via /api/service/makelog/ endpoint
- domainupload[.]rightwidth[.]devC2 subdomain for file stealer module — receives exfiltrated files via POST requests to /upload endpoint
- filenameserverValidation.jsMalicious JavaScript file in trojanized repos that reassembles Base64 payload fragments from SVG flag images and executes via eval()
- ip188[.]40[.]64[.]61OTTERCOOKIE C2 server IP address associated with rightwidth.dev infrastructure
- ip195[.]26[.]248[.]212OTTERCOOKIE C2 server IP address associated with rightwidth.dev infrastructure
- sha2563e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3cSHA-256 hash of trojanized repository next-ecommerce-private-main.zip
- sha2564e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864SHA-256 hash of trojanized repository shopping-platform-main.zip
- sha25654bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9SHA-256 hash of trojanized repository ecommerce-platform.zip
- sha2568e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1eSHA-256 hash of trojanized repository ecommerce-main.zip
- sha25696357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20SHA-256 hash of trojanized repository shop-main.zip
- sha2569df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886SHA-256 hash of trojanized repository ecommerce-platform-main.zip
- sha256c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9SHA-256 hash of trojanized repository shopping-platform.rar
- sha256cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730SHA-256 hash of trojanized repository shopping-platform.rar (second sample)
- sha256fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53fSHA-256 hash of trojanized repository shop-main.zip (second sample)
Detection / Hunteropenrouter
What Happened
A North Korean hacking group is targeting software developers by pretending to offer freelance coding jobs in online chat forums. Once a developer accepts the fake job test, they are given a project that looks legitimate but secretly contains hidden malware. The malware is cleverly concealed inside image files using a technique called steganography, making it very hard for antivirus software to detect. When the developer runs the project, the malware steals passwords saved in web browsers, cryptocurrency wallet data, sensitive files, and clipboard contents, while also giving the attackers remote control of the computer. Software developers and companies that employ them are affected, and this matters because compromising even one developer can lead to broader supply chain attacks. Developers should be extremely cautious about running code from unknown sources, verify the identity of anyone offering freelance work, and use isolated environments for testing unfamiliar code.
Key Takeaways
- DPRK-aligned Contagious Interview campaign (REF9403) uses fake coding challenges with trojanized repositories to target developers via community platforms like Slack
- Malware payloads are hidden using steganography inside SVG image files — Base64 fragments are embedded in HTML comments across flag images and reassembled at runtime by serverValidation.js
- Four-stage payload includes browser credential/crypto wallet stealer, file stealer, Socket.IO-based RAT, and clipboard stealer — converging OTTERCOOKIE and BEAVERTAIL capabilities into an all-in-one package
- Trojanized repositories had zero AV detections at time of writing and include fully functional code copied from legitimate open-source projects
- Campaign targets 25 cryptocurrency wallet browser extensions and exfiltrates browser credentials, keychain databases, source code, and sensitive developer files
Affected Systems
- Windows endpoints with Chrome, Edge, LT Browser, or Brave installed
- macOS endpoints with Chrome, Brave, Opera, LT Browser, or Edge installed
- Linux endpoints with Chrome, Edge, LT Browser, or Brave installed
- Developer workstations running Node.js projects (Next.js templates)
- Systems with cryptocurrency wallet browser extensions installed
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Threat actor poses as recruiter/employer in developer community platforms (Slack, forums) offering fake coding challenges via DM
- Execution: Victim downloads and runs trojanized repository (e.g., next-ecommerce-private-main.zip); server/index.js calls runServerValidation() on startup which triggers payload assembly
- Defense Evasion: serverValidation.js reads Base64 fragments from HTML comments in SVG flag images, reassembles them, decodes via custom Check() function, and executes via eval() to avoid standard Base64 detection
- Collection & Exfiltration: Four modules execute — browser credential/crypto wallet stealer exfiltrates to ldb.rightwidth.dev, file stealer scans drives and uploads to upload.rightwidth.dev, clipboard stealer polls every 500ms and sends to rightwidth.dev
- Command and Control: Socket.IO RAT establishes persistent HTTPS channel to controller.rightwidth.dev, providing interactive shell access via child_process.exec()
- Persistence/Impact: On Windows, dropper downloads additional payloads from file.rightwidth.dev disguised as .txt files, renamed to .exe and executed
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Elastic Endpoint Rules (TOML format on GitHub)
Elastic provides three detection rules in TOML format on their GitHub endpoint-rules and detection-rules repositories: 'Web Browser Credential Access via Scripting Utility', 'Ingress Tool Transfer via CURL', and 'Potential File Transfer via Curl for Windows'. No YARA, Sigma, Snort/Suricata, or SIEM query languages are provided.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe process creation (node.exe spawning powershell.exe for clipboard polling, curl.exe for payload downloads, wmic.exe for discovery), file writes to unusual paths (.npm/vhost.ctl), and masqueraded process titles (npm-cache). However, the malware runs within the Node.js runtime context, which may limit visibility into the JavaScript-level behavior such as eval() execution and SVG steganography decoding. |
| Network Visibility | High | All C2 communication uses HTTP/HTTPS to specific subdomains of rightwidth.dev with distinctive API endpoints (/api/service/makelog, /api/service/process/<uid>, /cldbs, /upload). The User-Agent string 'axios/1.18.1' and multipart POST requests for file exfiltration are network-detectable. Socket.IO traffic over HTTPS to controller.rightwidth.dev is also identifiable. |
| Detection Difficulty | Moderate | The C2 domains and API endpoints are distinctive and provide good network-level detection opportunities. However, the initial execution occurs within a legitimate Node.js development workflow, making it difficult to distinguish from normal developer activity without behavioral analysis. The SVG steganography technique and obfuscator.io protection further complicate static analysis. The zero AV detection rate at time of writing indicates traditional signature-based approaches are insufficient. |
Required Log Sources
- Process creation events (Sysmon Event ID 1 / EDR process telemetry)
- Network connection events (DNS resolution, HTTP/HTTPS traffic logs)
- File creation and modification events (Sysmon Event ID 11)
- PowerShell script block logging (Event ID 4104)
- Command-line auditing (Event ID 4688)
- DNS query logs or passive DNS
- Proxy/NGFW logs for HTTP/HTTPS inspection
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for Node.js processes spawning PowerShell with Get-Clipboard arguments at regular intervals, which would indicate the clipboard stealer module (T1115) | Process creation events with command-line logging, parent-child process relationships | Collection | Low — legitimate developer tools rarely invoke Get-Clipboard in a recurring pattern from node.exe |
| Hunt for DNS resolutions or HTTP connections to any subdomain of rightwidth.dev, which would indicate OTTERCOOKIE C2 communication | DNS logs, proxy logs, NGFW logs, EDR network telemetry | Command and Control | Very Low — this domain has no legitimate purpose |
| Hunt for curl.exe processes downloading .txt files that are subsequently renamed to .exe, which would indicate the Windows payload dropper stage | Process creation events, file system events, command-line logging | Execution | Low — this pattern is unusual in normal development workflows |
| Hunt for node.exe processes with the process title 'npm-cache' that are not associated with legitimate npm caching operations, which would indicate the credential stealer module masquerading | EDR process telemetry with process title/name information | Credential Access | Medium — legitimate npm cache processes may exist; correlation with network connections to C2 domains improves accuracy |
| Hunt for JavaScript files reading SVG files and extracting HTML comment blocks, which would indicate the steganography-based payload assembly technique (T1001.002) | File read events, script block logging, EDR file access telemetry | Defense Evasion | Medium — some legitimate build tools process SVG files, but extracting Base64 from HTML comments is unusual |
Control Gaps
- Traditional AV signature-based detection — trojanized repositories had zero detections at time of writing
- Static analysis of JavaScript — obfuscator.io protection and custom Base64 decoding evade simple string matching
- DNS-based blocking may be insufficient if subdomains are dynamically generated or if HTTPS inspection is not in place
- Developer endpoint protection policies may not restrict execution of untrusted Node.js projects or npm scripts
- Network DLP may not flag exfiltration over HTTPS C2 channels that appear as legitimate API traffic
Key Behavioral Indicators
- node.exe spawning powershell.exe with Get-Clipboard arguments at ~500ms intervals
- node.exe spawning curl.exe to download files from external domains
- Process titled 'npm-cache' making outbound HTTPS connections to non-npm infrastructure
- wmic.exe invoked by node.exe child processes for logicaldisk or computersystem enumeration
- File writes to .npm/vhost.ctl or similar PID lock files in npm cache directories
- DNS queries to rightwidth.dev or its subdomains (ldb, upload, controller, file)
- HTTP POST requests to /api/service/makelog, /api/service/process/, /cldbs, or /upload endpoints
- User-Agent string 'axios/1.18.1' associated with multipart file uploads to C2 domains
- SVG files in project assets/flags/ directories containing HTML comment blocks with Base64-encoded data
- JavaScript files named serverValidation.js that read SVG files and use eval() on decoded content
False Positive Assessment
Low — the C2 domains (rightwidth.dev and subdomains) have no legitimate purpose, and the behavioral indicators (node.exe spawning PowerShell for clipboard access, SVG steganography, process title masquerading as npm-cache) are highly specific to this campaign. The main false positive risk is from legitimate npm cache processes, but correlation with network connections to C2 infrastructure significantly reduces this risk.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Search endpoint and network logs for any connections to rightwidth.dev, its subdomains (ldb, upload, controller, file), or associated IPs (195.26.248.212, 188.40.64.61). If found, consider isolating affected hosts and initiating credential rotation for any browser-stored passwords or API keys on those machines.
- Consider blocking the rightwidth.dev domain and its subdomains at DNS, proxy, and firewall layers if your network security architecture supports it.
- If your EDR supports hash-based scanning, consider adding the nine listed SHA-256 hashes of trojanized repositories to blocklists or detection rules.
- Evaluate whether any developers in your organization may have recently accepted freelance coding challenges from unknown parties via Slack, Discord, or other community platforms — if so, consider scanning their workstations for the listed IOCs and behavioral indicators.
Infrastructure Hardening
- Consider implementing egress filtering or DNS sinkholing for known malicious domains to prevent C2 communication even if endpoints are compromised.
- If your network supports TLS inspection, consider inspecting HTTPS traffic to rightwidth.dev subdomains for the distinctive API endpoints (/api/service/makelog, /cldbs, /upload).
- Evaluate whether developer workstations need unrestricted internet access during development — consider implementing a development proxy or allowlist for npm/package registries.
- Consider deploying application whitelisting or execution controls for Node.js projects from untrusted sources, if supported by your endpoint platform.
User Protection
- Consider implementing browser extension management policies to control which cryptocurrency wallet extensions can be installed on corporate-managed browsers.
- If your EDR supports host isolation, consider pre-configuring isolation policies for developer endpoints that exhibit suspicious process behavior patterns (e.g., node.exe spawning PowerShell or curl).
- Evaluate whether developer workstations should have credential management tools (e.g., enterprise password managers) instead of relying on browser-stored credentials.
- Consider enabling enhanced PowerShell logging (Script Block Logging, Module Logging) on developer Windows endpoints if not already deployed.
Security Awareness
- Consider adding this campaign to existing security awareness training for developers, emphasizing the risk of running code from untrusted sources — even when presented as part of a job interview process.
- Encourage developers to verify the identity of anyone offering freelance work through independent channels before accepting coding challenges or downloading repositories.
- Consider promoting the use of isolated development environments (containers, VMs) for testing unfamiliar or untrusted code, if your development workflow supports it.
- Remind developers to report suspicious job offers or coding challenges received through community platforms (Slack, Discord, forums) to security teams.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- File Hashes:
4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864(SHA256) - SHA-256 hash of trojanized repository shopping-platform-main.zip54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9(SHA256) - SHA-256 hash of trojanized repository ecommerce-platform.zip96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20(SHA256) - SHA-256 hash of trojanized repository shop-main.zip9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886(SHA256) - SHA-256 hash of trojanized repository ecommerce-platform-main.zipc5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9(SHA256) - SHA-256 hash of trojanized repository shopping-platform.rarcc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730(SHA256) - SHA-256 hash of trojanized repository shopping-platform.rar (second sample)fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f(SHA256) - SHA-256 hash of trojanized repository shop-main.zip (second sample)
- File Paths:
C:\Users\jim\.npm\vhost.ctl- PID lock file written by Socket.IO RAT to enforce single-instance execution on Windows
- Command Lines:
- Purpose: Enumerate mounted drives for file exfiltration scanning | Tools:
wmic| Stage: File Stealer |wmic logicaldisk get name - Purpose: VM/sandbox detection on Windows to identify analysis environments | Tools:
wmic| Stage: Anti-Analysis |wmic computersystem get model,manufacturer - Purpose: Retrieve clipboard contents on Windows every 500ms for exfiltration | Tools:
powershell| Stage: Clipboard Stealer |powershell -NoProfile -NonInteractive Get-Clipboard - Purpose: Download second-stage Windows payloads disguised as .txt files | Tools:
curl| Stage: Payload Dropper |curl <url> -o <filename>.txt - Purpose: Retrieve clipboard contents on macOS for exfiltration | Tools:
pbpaste| Stage: Clipboard Stealer |pbpaste
- Purpose: Enumerate mounted drives for file exfiltration scanning | Tools:
- Other:
hostService.exe- Second-stage Windows payload dropped from file.rightwidth.dev (downloaded as hostService.txt then renamed)printSvc.exe- Second-stage Windows payload dropped from file.rightwidth.dev (downloaded as printSvc.txt then renamed)dhcpSvc.exe- Second-stage Windows payload dropped from file.rightwidth.dev (downloaded as dhcpSvc.txt then renamed)npm-cache- Masqueraded process title used by the browser credential/crypto wallet stealer module to avoid suspicion in process listings
