NVISO reports that DPRK-aligned Contagious Interview operators are abusing JSON Keeper, JSONsilo, npoint.io, GitLab, and GitHub to host and deliver malware through trojanized interview demo projects. The activity targets software developers across Windows, Linux, and macOS, with emphasis on cryptocurrency and Web3 roles, using fake recruiter outreach and staged coding tasks as the infection path. A base64-masked configuration value in the project points to JSON-hosted obfuscated code that resolves to BeaverTail, which steals system details, browser profiles, wallet extensions, documents, screenshots, secret files, and macOS Keychain data before fetching InvisibleFerret. The chain also includes Pastebin-based next-stage retrieval, a Tsunami component set for Defender exclusions, scheduled tasks, Python installation, and payload integrity verification, with infrastructure including 146.70.253.107, 23.254.164.156, and an offline .onion address. The use of legitimate JSON storage and code-hosting services helps the actors blend malicious delivery into normal developer workflows.