Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

## Executive Summary: SentinelLABS and Validin tracked activity from North Korea–aligned actors behind the “Contagious Interview” campaign (also linked to Lazarus) that use a ClickFix social-engineering lure to trick job applicants—mostly in the cryptocurrency sector—into running curl commands that fetch ContagiousDrop malware. The investigation observed coordinated team behavior (likely Slack), active use of CTI platforms (Validin, VirusTotal, Maltrail) to scout and monitor infrastructure, frequent OPSEC failures exposing logs and victim data (over 230 victims observed Jan–Mar 2025), rapid infrastructure churn to replace takedowns, and numerous IOCs (email addresses, domains, IPs, and SHA‑1 hashes) to support defensive action and takedown efforts.