This is the second instance where we have observed connections between the Contagious Interview malware campaign and North Korean IT worker activities, also known as the Wagemole campaign. Since our previous report on the two job-related campaigns, some researchers have begun attributing the Contagious Interview campaign to the well-known North Korean threat group, Lazarus. Fake North Korean IT Worker CL-STA-0237 Linked to the Phishing Attack Our internal telemetry identified newly registered domains resolving to a known IP address, 167.88.36[.]13, which is associated with the MiroTalk fake job campaign from July 2024 discussed above. Despite this uncertainty, we continue to observe links between malware campaigns and North Korean IT workers, thus we track these activities under our temporary cluster names.