Jamf identified 14 trojanized macOS DMG and PKG samples tied to the DPRK-attributed Contagious Interview campaign, extending its delivery methods beyond fake coding tests, Visual Studio Code task files, and Git hooks. The unsigned installers launched legitimate applications as decoys while retrieving a multi-stage chain from 162.0.239.85. Its final OtterCookie payload provided remote access, stole browser and cryptocurrency-wallet credentials, scanned sensitive files, and monitored the clipboard. Shared infrastructure included several domains resolving to the same server, with the payload listener operating on port 3000.