A search-driven malvertising chain displayed a fake macOS update and used ClickFix instructions to make victims paste a Node.js backdoor command into Terminal. The implant retrieved rotating C2 configuration from Ethereum smart contracts, executed JavaScript tasks remotely, stole cryptocurrency-wallet, browser, developer, and cloud credentials, and sideloaded a malicious Chrome extension. AllSecure linked the backdoor, extension, disposable deployment wallets, and laundering paths to one operation matching DPRK-linked UNC5342 and the Contagious Interview campaign. The report identifies previously unreported C2 domains and Ethereum infrastructure associated with the activity.