Loading threat actor…
REF9403 is a North Korea-aligned activity cluster associated with the broader Contagious Interview operation. It targets software developers, particularly those working in cryptocurrency and Web3, through fraudulent recruitment messages and trojanized take-home coding assessments. Activity observed in May 2026 used a developer community Slack workspace to advertise fictitious jobs, move prospective applicants into private conversations, and deliver malicious repositories disguised as functional e-commerce projects. The repositories conceal Base64-encoded JavaScript payload fragments inside comments in SVG images. Application startup code reconstructs and executes the hidden malware while preserving the project's apparent functionality. The payload overlaps with OTTERCOOKIE in code, behavior, and infrastructure. Its components operate across Windows, macOS, and Linux and provide browser credential theft, cryptocurrency-wallet data theft, sensitive-file collection, clipboard monitoring, and remote command execution through a Socket.IO-based backdoor. Collection targets include developer source code, cloud credentials, cryptographic keys, browser autofill information, wallet-extension data, and macOS keychain data. A Windows-specific component can also download and execute additional payloads. Defense-evasion techniques include image-based payload concealment, custom decoding, process masquerading, and virtual-machine and sandbox checks. Compromised developer environments expose organizational secrets and source-code access, creating opportunities for downstream supply-chain compromise. REF9403 is a campaign-tracking designation within Contagious Interview, rather than an established alias for the entire operation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A North Korean activity cluster associated with a campaign using fake coding interviews to steal developer credentials. The post tags the campaign with BeaverTail and OtterCookie but provides no further operational details.
A DPRK-linked social-engineering campaign using fake recruiter job lures and trojanized coding challenge repositories to infect software developers, steal credentials, crypto wallet data, developer files, and provide backdoor shell access.
Developer-focused social-engineering campaign using fake job coding tests to deliver OTTERCOOKIE-aligned malware hidden in SVG image assets inside a working e-commerce project.
North Korea-linked activity cluster using fake recruiter lures and SVG comment-block steganography to deliver multi-component malware to developers.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.