REF9403 is the tracking designation Elastic Security Labs assigned to a DPRK-aligned campaign, identified in 2026, that is linked to the broader Contagious Interview activity. Elastic discovered the operation after an operator posted a fake developer job offer in Elastic's own community Slack workspace and directed an interested user to complete a coding assignment using a trojanized software repository. The malicious repositories concealed JavaScript payloads as Base64 fragments hidden inside SVG image files, which were reassembled and executed to deploy credential, cryptocurrency-wallet, clipboard, and file-stealing modules alongside a remote-access capability. Elastic linked the activity to Contagious Interview based on code, behavioral, and infrastructure overlaps with malware known as OTTERCOOKIE, noting that the historical distinction between OTTERCOOKIE and an earlier malware family, BEAVERTAIL, has become increasingly blurred as the operators converge capabilities into single payloads targeting software developers.