North Korean threat actors, linked to the ‘Contagious Interview’ campaign, are employing steganography to hide malicious payloads within SVG image files. These files are distributed through fake job postings and coding challenges. The multi-stage payload, aligned with ‘OTTERCOOKIE,’ includes a browser credential and crypto wallet stealer, as well as a file stealer, posing a significant threat to job seekers and developers.