Moonlock Lab analyzed an active Contagious Interview chain targeting macOS users with a fake Git helper shell script that downloads a Node.js runner and an obfuscated OtterCookie payload. The payload steals browser passwords and Keychain data, scans files and clipboard contents, targets 40 cryptocurrency wallet extensions, and provides remote shell and file-access capabilities. Three workers beacon to 104.194.153.144, while the lure infrastructure uses githelper.store. Researchers said the payload's comments and inconsistent construction suggest increasing use of AI-generated code, although this remains an assessment rather than a proven development method.