North Korean Hackers Hide Crypto-Stealing Malware in SVG Files
Contagious Interview is a long-running social-engineering campaign attributed to North Korean-linked hackers. Operatives pose as recruiters and use coding tests or job interviews to persuade software developers to download compromised projects. The targeting is significant because developers often hold source-code access, cloud credentials, browser sessions and cryptocurrency wallets, giving attackers both immediately valuable data and a potential route into corporate systems.
Elastic Security Labs disclosed the latest technique on July 29, 2026, saying attackers divided malicious code across multiple SVG image files to make repositories appear harmless. When a developer runs the project, the concealed components are reconstructed and loaded. The malware steals cryptocurrency-wallet data, browser credentials and cloud configurations before installing a remote-access backdoor. Elastic did not disclose the number of victims or any associated financial losses.
All Coverage
1 original reportsThe Backstory
The history behind this eventNorth Korean Hackers Launch PolinRider Supply-Chain Attack to Steal Cryptocurrency
PolinRider is a software supply-chain attack that the North Korean hacking group Contagious Interview, also known as Famous Chollima, has conducted since December 2025. The group uses fake recruitment campaigns and compromised accounts belonging to open-source maintainers to infiltrate development environments and steal corporate credentials, source code and cryptocurrency wallets. The threat can spread through package dependencies into corporate CI/CD systems.
On July 7, 2026, iThome cited a Socket investigation showing that PolinRider had infiltrated 108 packages across NPM, Packagist, Go modules and the Chrome Web Store, releasing 162 malicious versions. The campaign remained active. Separately that day, JFrog disclosed six malicious NPM packages masquerading as Rollup tools. No figures are currently available for the number of victims or the value of losses.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.