DPRK's Contagious Interview campaign combined fake recruiter and interview lures with ErrTraffic-style ClickFix overlays on compromised WordPress sites and fake cryptocurrency-company pages. These routes delivered portable Node.js loaders that resolved C2 addresses through Polygon smart contracts and executed a RAT in memory. The malware established Run-key persistence, captured keystrokes and clipboard data, and deployed tooling to access Chrome passwords and cookies. A shared treasury wallet, team-labelled contracts, C2 fingerprints, and victim reporting linked the delivery routes to common infrastructure.