Elastic identified REF9403, a DPRK-aligned Contagious Interview campaign that delivered trojanized coding challenges through fake developer recruitment and concealed payload fragments in SVG flag images. Running the project reconstructed and executed an OTTERCOOKIE-aligned JavaScript implant with browser and wallet theft, sensitive-file collection, clipboard monitoring, and Socket.IO remote access. The malware operated across Windows, macOS, and Linux and used rightwidth.dev infrastructure for command-and-control and exfiltration. Elastic linked the activity to earlier DPRK operations through code, behavioral, endpoint, and infrastructure overlaps.