Moonlock describes a fake-interview campaign that lures job seekers into running commands from malicious recruiting sites, with a focus on cryptocurrency theft. The macOS chain downloads ffmpeg.sh, selects an ARM or Intel VCam archive from attacker infrastructure, installs vcamservice.sh under /var/tmp/VCam, and registers a LaunchAgent at ~/Library/LaunchAgents/com.vcam.plist for persistence. The package also launches ChromeUpdateAlert.app while the backdoor remains available for remote command execution. The source tracks rotating fake-interview domains and notes attempts to abuse cryptocurrency-related browser-extension permissions, including MetaMask, to reach wallet data.