DPRK-linked CL-STA-0240 Contagious Interview operators are posing as recruiters on job platforms and social media to push fake video-call applications to technology job seekers. Unit 42 observed newer Qt-based BeaverTail builds for macOS and Windows, including fake MiroTalk and FreeConference installers, that steal browser data and cryptocurrency wallets while connecting to infrastructure such as 95.164.17[.]24:1224. The report also notes continued code changes to BeaverTail and the InvisibleFerret backdoor delivered in the campaign. The activity remains financially relevant because the malware targets cryptocurrency wallets while using hiring workflows as the delivery channel.