Elastic Details Contagious Interview Campaign Using SVG Steganography to Target Developers
Summary
Elastic details REF9403, a Contagious Interview campaign using fake coding challenges and SVG steganography to target developers. Startup-triggered payloads steal credentials, wallet data, files and clipboard contents and provide a Socket.IO RAT.
Key points
- Elastic Security Labs traced the activity to fake job offers and coding challenges sent to developers, including direct messages in its community Slack workspace.
- Trojanized but functional-looking repositories hid Base64 payload fragments in SVG flag-image comments; JavaScript reassembled and evaluated them when the server started.
- The four payload modules steal browser credentials and wallet data, sweep local files, provide a Socket.IO RAT with interactive shell access, and capture clipboard contents.
- The file stealer targets documents, source code, configuration files and shell histories; on Windows it scans mounted drives, while macOS and Linux scans focus on home directories.
- Elastic linked the samples to Contagious Interview and OTTERCOOKIE based on code, behavior and infrastructure similarities; it noted that the distinction between OTTERCOOKIE and BEAVERTAIL is unclear.
- The reported C2 infrastructure included rightwidth[.]dev and related subdomains. Some users reported suspicious behavior after running challenges, and some unknowingly published trojanized repositories.
- The C2 host for three Windows binaries was unavailable during analysis, so Elastic could not retrieve them; their capabilities remain unconfirmed.
Article Details
- Attack Vectors
- Fake job offers and coding challenges were sent to developers through open forums and Slack direct messages.
- Trojanized, functional e-commerce repositories executed malicious JavaScript when victims started the server with npm scripts.
- Payload fragments were Base64-encoded in comments within SVG flag images, reassembled by repository JavaScript, decoded, and executed with eval().
- The malware stole browser credentials, wallet data, local files, and clipboard contents, and provided interactive shell access through a Socket.IO RAT.
- On Windows, the malware downloaded second-stage binaries from file.rightwidth[.]dev disguised as .txt files, renamed them to .exe, and attempted to execute them.
- Defensive Notes
- Treat coding challenge repositories received through unsolicited job offers as untrusted, even when their application code appears functional.
- Review repository startup scripts and server-side JavaScript for unexpected execution, and inspect SVG files for encoded data in comments.
- Investigate connections to the reported rightwidth[.]dev infrastructure and look for unexpected credential, wallet, file, or clipboard data uploads.
- The article reports that some victims unknowingly published the trojanized repositories; review repositories shared after running such challenges.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | controller[.]rightwidth[.]dev | Reported Socket.IO RAT command-and-control host used for victim registration and interactive shell access. |
| DOMAIN | file[.]rightwidth[.]dev | Reported host used to deliver Windows second-stage binaries. |
| DOMAIN | ldb[.]rightwidth[.]dev | Reported C2 host used to exfiltrate browser credentials and cryptocurrency wallet data. |
| DOMAIN | rightwidth[.]dev | Reported C2 infrastructure used for clipboard-data exfiltration and associated with the OTTERCOOKIE-aligned malware. |
| DOMAIN | upload[.]rightwidth[.]dev | Reported file-stealer host used to upload files from victim systems. |
| IPV4 | 188[.]40[.]64[.]61 | Identified in the article's indicators as OTTERCOOKIE C2 infrastructure. |
| IPV4 | 195[.]26[.]248[.]212 | Identified in the article's indicators as OTTERCOOKIE C2 infrastructure. |
| SHA256 | 3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c | SHA-256 of the trojanized next-ecommerce-private-main.zip repository sample. |
| SHA256 | 4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864 | SHA-256 of the trojanized shopping-platform-main.zip repository sample. |
| SHA256 | 54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9 | SHA-256 of the trojanized ecommerce-platform.zip repository sample. |
| SHA256 | 8e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1e | SHA-256 of the trojanized ecommerce-main.zip repository sample. |
| SHA256 | 96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20 | SHA-256 of the trojanized shop-main.zip repository sample. |
| SHA256 | 9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886 | SHA-256 of the trojanized ecommerce-platform-main.zip repository sample. |
| SHA256 | c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9 | SHA-256 of a trojanized shopping-platform.rar repository sample. |
| SHA256 | cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730 | SHA-256 of a trojanized shopping-platform.rar repository sample. |
| SHA256 | fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f | SHA-256 of a trojanized shop-main.zip repository sample. |
MITRE ATT&CK
T1005 · Data from Local SystemThe file-stealing module scans drives or home directories for documents, source files, configuration data, and shell histories.T1027 · Obfuscated Files or InformationThe malware uses obfuscator.io and encoded payload fragments to make its JavaScript harder to analyze.T1027.003 · SteganographyBase64 malware fragments are concealed in comments inside SVG flag images and reassembled by repository code.T1036 · MasqueradingThe browser and wallet stealer sets its process title to npm-cache to appear like benign npm activity.T1041 · Exfiltration Over C2 ChannelThe malware sends stolen browser data, files, wallet databases, and clipboard contents to its C2 infrastructure.T1059.001 · PowerShellOn Windows, the malware launches PowerShell with Get-Clipboard to retrieve clipboard contents.T1059.007 · JavaScriptRepository JavaScript reconstructs and decodes the hidden payload, then executes it with eval() when the server starts.T1071.001 · Web ProtocolsThe RAT maintains a Socket.IO command-and-control channel over HTTPS to controller.rightwidth[.]dev.T1082 · System Information DiscoveryThe RAT collects host information using system-specific commands and queries.T1105 · Ingress Tool TransferThe Windows component downloads three second-stage binaries from file.rightwidth[.]dev before renaming and executing them.T1115 · Clipboard DataThe malware polls victim clipboards every 500 milliseconds and sends changed contents to its C2 infrastructure.T1204.002 · Malicious FileVictims who ran the trojanized coding-challenge repositories triggered the embedded malware.T1497.001 · System ChecksThe malware checks system details for VMware, VirtualBox, QEMU, and other virtualization indicators, then tags C2 responses when a match is found.T1555.001 · KeychainOn macOS, the malware exfiltrates the system login keychain database.T1555.003 · Credentials from Web BrowsersThe malware collects saved browser credentials from browser profile databases.