JADESNOW is a JavaScript downloader associated with the North Korean threat cluster UNC5342 and used in the social-engineering campaign known as Contagious Interview. Since February 2025, the campaign has used JADESNOW to deploy a JavaScript variant of INVISIBLEFERRET in operations linked to cryptocurrency theft. JADESNOW applies EtherHiding, retrieving malicious payloads stored in smart contracts on BNB Smart Chain or Ethereum, decrypting them, and executing them. Smart-contract input may be Base64 encoded and XOR encrypted. This use of public blockchains creates resilient command-and-control infrastructure, while initial access commonly relies on lures such as fake job interviews or cryptocurrency games.