North Korea–linked actors used fake developer job offers inside a Slack community to trick targets into running a “coding assessment” project. The repository looked legitimate but secretly assembled malware hidden in SVG flag images, leading to credential, file, crypto-wallet, and clipboard theft plus remote access.
The operation began with a job lure posted in a community Slack's #jobs channel, offering a developer role focused on upgrading an e-commerce platform with a modern stack. Interested developers who responded were moved from the public channel into direct messages, where they were instructed to complete a coding assessment as part of the hiring process. This assessment took the form of a repository that looked like a normal, functional software project.
The repository was not what it appeared to be. Malicious payload fragments were hidden as Base64 text inside HTML comments across SVG flag images stored in an assets directory. A JavaScript file, serverValidation.js, reassembled these fragments into a multi-stage payload aligned with the OTTERCOOKIE malware family. Because the visible code ran perfectly fine, developers had no obvious reason to suspect anything was wrong while the hidden code executed in the background.
The lure exploited normal hiring workflows that developers encounter regularly: an unsolicited job offer, a move to private messaging to discuss details, and a request to complete a coding assessment. Each step mirrors legitimate recruiting practices, which lowered suspicion. The malicious repository's outward functionality reinforced the illusion of legitimacy, since running the project produced no visible errors or warning signs.
Hiding payload fragments inside image files rather than in obviously executable code also helped the operation evade casual review and some automated scanning, since SVG assets are not typically treated as a place to look for malicious logic.
Organizations should treat this pattern as a reminder that developers are high-value targets because their systems and credentials can open the door to broader supply chain compromise. Useful steps include independently verifying recruiters and companies before engaging, reviewing unfamiliar repositories in isolated or sandboxed environments before execution, and training engineering teams to treat any workflow that moves from a public channel to private messages, especially one involving code execution, as worth extra scrutiny. Building this awareness into onboarding and ongoing security training for developers can reduce the chance that a single compromised individual becomes an entry point for a larger incident.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers posted job lures in a Slack community's #jobs channel, then moved interested developers into direct messages to continue the recruiting pretext.
The malicious payload was split into Base64 fragments hidden inside HTML comments within SVG flag images, then reassembled by a JavaScript file, so the repository ran normally while malicious code triggered silently in the background.
The operation focused on stealing browser credentials, crypto wallet data, and files, plus enabling remote access and clipboard theft.
Compromising a single developer can provide the initial access needed to enable broader supply chain attacks against downstream organizations.
You’re in a dev Slack, #jobs channel, and someone named Maxwell posts a sweet Next.js 14 gig. Looks legit, right? Maxwell pulls you into DMs, sends a Git repo as a “coding assessment,” and asks you to run it locally. The app works fine, but behind the scenes a script called serverValidation.js is rebuilding malware hidden inside SVG flag images. That’s the OTTERCOOKIE chain: it silently grabs your browser passwords, crypto wallets, files, even lets someone remote into your machine, all from a “test project” you ran for a fake interview. Here’s the move: if a Slack job lead asks you to run their repo, stop and verify the recruiter and company yourself before you run a single command.
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
Attackers used fake Steam forum replies that looked like helpful troubleshooting steps for real gaming/PC problems. The posts tricked users into running PowerShell as an administrator, which then downloaded and installed the XMRig crypto miner and set it to run automatically at startup. The…
AI firm ORO says a suspected North Korean attacker hijacked a real conference contact’s Telegram account and lured an employee into joining a fake Microsoft Teams call link. After the call “had no working audio,” the victim approved what looked like a Teams update, which installed a malicious…
Researchers linked DigiCert’s April 2026 breach to a GoldenEyeDog sub-group that tricked support staff into running a malicious file delivered through a customer support chat. The attackers then abused DigiCert’s support portal features to intercept EV code-signing certificate “initialization…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
