SentinelLABS and Validin observed North Korea-aligned Contagious Interview operators creating and using cyber intelligence platform accounts to monitor their own exposed infrastructure. The activity is tied to the ClickFix-style job seeker lure chain, where targets are directed to fake assessment sites and instructed to run commands that download malware. The actors used Gmail accounts already tracked as campaign artifacts, registered from VPN-linked IPs, and appeared to coordinate through multiple CTI sources including Validin, VirusTotal, and Maltrail, with indicators of real-time teamwork such as Slack use. Despite inspecting detection artifacts and scouting new assets before acquisition, they made only limited defensive changes and instead rapidly replaced disrupted infrastructure, supporting continued victim engagement that SentinelLABS measured at more than 230 affected individuals from January to March 2025.