--- title: Can Malware Still Hide Inside Images? What Happened in... description: Elastic Security Labs disclosed REF9403, a DPRK-linked campaign (Contagious Interview) where attackers posed as recruiters and delivered a trojanized Next.js... canonical: https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Can Malware Still Hide Inside Images? What Happened in REF9403 | daily.dev og:description: Elastic Security Labs disclosed REF9403, a DPRK-linked campaign (Contagious Interview) where attackers posed as recruiters and delivered a trojanized Next.js... og:url: https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika og:image: https://api.daily.dev/og/posts/ecsqHxIkA.png og:image:alt: Can Malware Still Hide Inside Images? What Happened in REF9403 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Can Malware Still Hide Inside Images? What Happened in REF9403 **[Medium](https://daily.dev/sources/medium_js)** · 12 min read · 1 upvotes · 0 comments ## Summary Elastic Security Labs disclosed REF9403, a DPRK-linked campaign (Contagious Interview) where attackers posed as recruiters and delivered a trojanized Next.js e-commerce project as a fake coding assessment. The project hid Base64-encoded malware fragments inside SVG country-flag files as comment blocks. A malicious serverValidation.js file read, reassembled, decoded, and executed the payload when developers ran npm run dev or npm start. The malware (OTTERCOOKIE-aligned) could steal browser credentials, cryptocurrency wallet data, files, SSH keys, and cloud credentials, and included a Socket.IO remote-access backdoor. Simply viewing the SVG files was not dangerous — execution required running the project. The post explains the attack chain in detail and provides practical guidance for safely handling unfamiliar coding assessments, including environment isolation, reviewing package.json scripts, and credential rotation after suspected compromise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can opening or viewing an SVG image file actually infect my computer with malware? Not by itself. In the REF9403 campaign documented by Elastic Security Labs, malicious payload fragments were hidden as Base64-encoded text inside SVG comment blocks, but the images did not execute anything when viewed in a browser or image viewer. Infection required separate malicious JavaScript to read the SVG files, reconstruct the fragments, decode them, and deliberately execute the result during server startup. _Developers wary of hidden exploits in file formats can follow ongoing security research breakdowns on daily.dev._ ### How did the OTTERCOOKIE malware get triggered in the REF9403 fake job interview campaign? A file named serverValidation.js read SVG flag images from the project's assets folder, sorted them alphabetically, extracted Base64-encoded fragments hidden in comment blocks, joined and decoded them, then executed the resulting JavaScript. This function ran automatically during server startup, so running either npm run dev or npm start on the trojanized Next.js e-commerce project triggered the payload. _Anyone auditing unfamiliar repos before running them can track supply-chain attack techniques like this on daily.dev._ ### What data does the OTTERCOOKIE-aligned malware steal from a compromised developer machine? It includes four components: a browser credential and cryptocurrency-wallet data stealer, a file-stealing module targeting SSH keys, env files, cloud directories, shell histories and source code, a Socket.IO-based remote-access backdoor, and a clipboard-stealing component that can also fetch additional executables on Windows. Clipboard monitoring used PowerShell on Windows and pbpaste on macOS, but was not implemented on Linux samples. _Developers assessing how much a compromised dev box could expose can dig deeper into incidents like this via daily.dev._ ## Similar posts on daily.dev - [Contagious Interview malware in SVG images: DPRK campaign — Elastic Security Labs](https://daily.dev/posts/contagious-interview-malware-in-svg-images-dprk-campaign-elastic-security-labs-fowc488dv) · Elastic Security Labs · 2 upvotes · 0 comments - [How I \(Almost\) Got Hit by a Fake Recruiter Malware Scam — and How Claude Helped Me Catch It](https://daily.dev/posts/how-i-almost-got-hit-by-a-fake-recruiter-malware-scam-and-how-claude-helped-me-catch-it-2iteehrpf) · Medium · 0 upvotes · 0 comments - [This Web3 Interview Task Was Actually a Remote Access Trojan](https://daily.dev/posts/this-web3-interview-task-was-actually-a-remote-access-trojan-1n56iswio) · Coins Bench · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#svg](https://daily.dev/tags/svg) [View this post on daily.dev](https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Can Malware Still Hide Inside Images? What Happened in REF9403","url":"https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika"},"datePublished":"2026-07-23T17:47:28.717Z","dateModified":"2026-09-14T06:13:39.660Z","description":"Elastic Security Labs disclosed REF9403, a DPRK-linked campaign (Contagious Interview) where attackers posed as recruiters and delivered a trojanized Next.js...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61e3a281be7942bac4e055336dbf4946?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61e3a281be7942bac4e055336dbf4946?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,svg","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Can Malware Still Hide Inside Images? What Happened in REF9403"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/can-malware-still-hide-inside-images-what-happened-in-ref9403-ecsqhxika#faq","mainEntity":[{"@type":"Question","name":"Can opening or viewing an SVG image file actually infect my computer with malware?","acceptedAnswer":{"@type":"Answer","text":"Not by itself. In the REF9403 campaign documented by Elastic Security Labs, malicious payload fragments were hidden as Base64-encoded text inside SVG comment blocks, but the images did not execute anything when viewed in a browser or image viewer. Infection required separate malicious JavaScript to read the SVG files, reconstruct the fragments, decode them, and deliberately execute the result during server startup. Developers wary of hidden exploits in file formats can follow ongoing security research breakdowns on daily.dev."}},{"@type":"Question","name":"How did the OTTERCOOKIE malware get triggered in the REF9403 fake job interview campaign?","acceptedAnswer":{"@type":"Answer","text":"A file named serverValidation.js read SVG flag images from the project's assets folder, sorted them alphabetically, extracted Base64-encoded fragments hidden in comment blocks, joined and decoded them, then executed the resulting JavaScript. This function ran automatically during server startup, so running either npm run dev or npm start on the trojanized Next.js e-commerce project triggered the payload. Anyone auditing unfamiliar repos before running them can track supply-chain attack techniques like this on daily.dev."}},{"@type":"Question","name":"What data does the OTTERCOOKIE-aligned malware steal from a compromised developer machine?","acceptedAnswer":{"@type":"Answer","text":"It includes four components: a browser credential and cryptocurrency-wallet data stealer, a file-stealing module targeting SSH keys, env files, cloud directories, shell histories and source code, a Socket.IO-based remote-access backdoor, and a clipboard-stealing component that can also fetch additional executables on Windows. Clipboard monitoring used PowerShell on Windows and pbpaste on macOS, but was not implemented on Linux samples. Developers assessing how much a compromised dev box could expose can dig deeper into incidents like this via daily.dev."}}]} ```