CONTAGIOUS INTERVIEW MALWARE IN SVG IMAGES: DPRK CAMPAIGN

Summary from the TLDR Dev newsletter

DPRK-aligned actors are handing developers fully-functional “coding challenge” repos, one seeded through Elastic's own community Slack #jobs channel, with the payload split into Base64 chunks hidden in HTML comments across SVG flag images. It is reassembled and executed on every npm run dev or npm start. What lands is a four-module OTTERCOOKIE stack: browser credential and crypto wallet theft, a recursive sweep for .env files, SSH/AWS configs and shell histories, a Socket.IO RAT with live shell access, and a clipboard stealer.