Fake coding tests deliver OtterCookie malware via SVG images

North Korean threat actors in the Contagious Interview campaign use steganography in SVG flag images to hide OtterCookie malware. Fake job postings on Slack target developers with coding assessments containing trojanized repositories. The four-stage payload steals browser credentials, crypto wallets, files, and clipboard data via a Socket.IO-based RAT.