North Korea–linked actors used fake developer job offers inside a Slack community to trick targets into running a “coding assessment” project. The repository looked legitimate but secretly assembled malware hidden in SVG flag images, leading to credential, file, crypto-wallet, and clipboard theft plus remote access.
The operation began with a job lure posted in a community Slack's #jobs channel, offering a developer role focused on upgrading an e-commerce platform with a modern stack. Interested developers who responded were moved from the public channel into direct messages, where they were instructed to complete a coding assessment as part of the hiring process. This assessment took the form of a repository that looked like a normal, functional software project.
The repository was not what it appeared to be. Malicious payload fragments were hidden as Base64 text inside HTML comments across SVG flag images stored in an assets directory. A JavaScript file, serverValidation.js, reassembled these fragments into a multi-stage payload aligned with the OTTERCOOKIE malware family. Because the visible code ran perfectly fine, developers had no obvious reason to suspect anything was wrong while the hidden code executed in the background.
The lure exploited normal hiring workflows that developers encounter regularly: an unsolicited job offer, a move to private messaging to discuss details, and a request to complete a coding assessment. Each step mirrors legitimate recruiting practices, which lowered suspicion. The malicious repository's outward functionality reinforced the illusion of legitimacy, since running the project produced no visible errors or warning signs.
Hiding payload fragments inside image files rather than in obviously executable code also helped the operation evade casual review and some automated scanning, since SVG assets are not typically treated as a place to look for malicious logic.
Organizations should treat this pattern as a reminder that developers are high-value targets because their systems and credentials can open the door to broader supply chain compromise. Useful steps include independently verifying recruiters and companies before engaging, reviewing unfamiliar repositories in isolated or sandboxed environments before execution, and training engineering teams to treat any workflow that moves from a public channel to private messages, especially one involving code execution, as worth extra scrutiny. Building this awareness into onboarding and ongoing security training for developers can reduce the chance that a single compromised individual becomes an entry point for a larger incident.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers posted job lures in a Slack community's #jobs channel, then moved interested developers into direct messages to continue the recruiting pretext.
The malicious payload was split into Base64 fragments hidden inside HTML comments within SVG flag images, then reassembled by a JavaScript file, so the repository ran normally while malicious code triggered silently in the background.
The operation focused on stealing browser credentials, crypto wallet data, and files, plus enabling remote access and clipboard theft.
Compromising a single developer can provide the initial access needed to enable broader supply chain attacks against downstream organizations.
You’re in a dev Slack, #jobs channel, and someone named Maxwell posts a sweet Next.js 14 gig. Looks legit, right? Maxwell pulls you into DMs, sends a Git repo as a “coding assessment,” and asks you to run it locally. The app works fine, but behind the scenes a script called serverValidation.js is rebuilding malware hidden inside SVG flag images. That’s the OTTERCOOKIE chain: it silently grabs your browser passwords, crypto wallets, files, even lets someone remote into your machine, all from a “test project” you ran for a fake interview. Here’s the move: if a Slack job lead asks you to run their repo, stop and verify the recruiter and company yourself before you run a single command.
Researchers found attackers impersonating LastPass with a fake GitHub “LastPass Authenticator” download page that tricks people into downloading a large ZIP and running a fake installer. The installer uses a Microsoft-signed Windows driver to shut down antivirus/EDR tools, then runs a password…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
An unknown group suspected to be North Korean state hackers targeted Rust language team members and high-profile package (“crate”) maintainers with phishing that lures victims into a fake conference call. When the victim tries to join, they are told they must install a “video codec” or update…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Researchers linked the Iran-aligned Handala Hack persona to a Telegram-controlled backdoor (HEAVYGRAM) that can steal passwords and exfiltrate chat data. The campaign reportedly starts with social engineering on messaging apps (Telegram, WhatsApp, Instagram), where the attacker pretends to offer…
UK, US, and Dutch agencies warned that Iranian state-linked actors used social messaging apps to build trust with dissidents, journalists, and activists before sending disguised files that install Windows malware. The attackers often impersonated someone the target already knows or “technical…
