QiAnXin tied a suspected Lazarus/APT-Q-1 campaign against blockchain developers to the Contagious Interview activity pattern previously reported by Unit 42. Attackers created fake employer, developer, or startup-founder personas on LinkedIn, Upwork, Braintrust, and code-hosting platforms, then persuaded targets to run supplied project code as a coding test or bug-fix task. The ZIP-delivered projects contained malicious JavaScript that collected browser passwords, keychain data, and cryptocurrency wallet extension data across Windows, Linux, and macOS, then sent stolen data to C2 infrastructure such as 147.124.214.237:1244. Follow-on Python components downloaded payloads from endpoints including /clients/, /payload/, and /brow/, with behavior matching BeaverTail and InvisibleFerret and C2 overlap with earlier Contagious Interview samples. The report treats the Lazarus link as probable based on infrastructure overlap, phishing tradecraft, and the group’s long-running focus on cryptocurrency and blockchain targets.