North Korea-linked groups concentrated on developers and IT professionals through fake recruitment, technical interviews, coding assignments, malicious LNK files, and GitHub-based delivery. Famous Chollima’s Contagious Interview activity used OtterCookie for information theft and remote access, while PolinRider propagated through compromised GitHub accounts and repositories. Kimsuky divided operational functions among GitHub, WordPress, Dropbox, and Pinggy, and Konni used the VelvetCake downloader for information collection and screenshots.