Malware Stored in SVG Images Used to Hack Developers' Machines

According to Cyber Security News, North Korean hackers are targeting developers with fake job interviews containing malicious code stored in SVG images.

The malware is related to the OTTERCOOKIE family of malware deployed by North Korean-linked hackers to steal credentials from developers through fake coding challenges designed to look like a job interview.

In this particular case, developers respond to a job offer and receive what appears to be an e-commerce project that they're asked to run locally.

The campaign reportedly started with job messages in a community Slack channel, where they would directly contact developers and send them a malicious coding assignment to finish.

The software seems legitimate with no obvious malicious code. The project contains two SVG images depicting country flags, AE.svg and AF.svg.

These images hold the malicious code: inside are HTML comment blocks containing the Base64-encoded payload, allowing the malware to easily slip by inspection by the developers and by malware scanning tools.

A JavaScript file called serverValidation.js reads the obfuscated code fragments stored in the SVGs and reconstitutes them into the functioning malware when the project is run.

The hidden payload runs automatically when the server boots, and the project functions normally to avoid suspicion. Most wouldn't know anything was wrong.

Once the malware is running, it has four parts: a browser credential and crypt wallet stealer, a file stealer, a clipboard collector, and a remote-access component. All of these parts allow it to collect sensitive data and allow the attackers to run commands on the afflicted system.

Developers should never run unsolicited programs sent to them, even if the software seems benign and works properly.

Cyber Security News says before running coding tests, developers should look at the startup files and assets and check for dynamic code execution such as eval() or code that reads image files.

Any machines that ran a suspected project should be isolated and have their browser tokens reviewed and keys and credentials rotated.

It's important to remember that being more technically-inclined isn't necessarily a panacea against social engineering, and in fact it can make you even more susceptible to specific types of attacks.

Also never assume images or other types of media files are inherently safe; they can contain exploits and malware just like anything else.

Make sure you know what you are running and from who before you run it.