Recent Contagious Interview activity attributed in the source to North Korean threat actors targets cryptocurrency, Web3, and AI professionals through fake technical assessments and trojanized NPM packages. The updated first-stage JavaScript has been reduced to beaconing, retrieving next-stage C2 details, and downloading additional payloads, including file-stealing JavaScript, a lightweight backdoor, and the Python-based InvisibleFerret backdoor. The malware searches Windows, macOS, and Linux systems for browser credentials, cryptocurrency wallets, password-manager files, private keys, seed phrases, KeePass databases, Solana artifacts, Hardhat files, and related developer secrets. A notable added capability uses a backdoor command to fetch a script that replaces the legitimate MetaMask extension in Chrome or Brave with an attacker-controlled version, modifies browser preference protections, and captures wallet unlock passwords through attacker C2 infrastructure.