Sekoia describes ClickFake Interview, a Lazarus campaign that targets cryptocurrency job seekers through fake interview websites and uses ClickFix-style instructions to make victims run malicious commands. The operation is assessed with high confidence as a continuation of Contagious Interview, based on overlaps in social engineering flow and infrastructure. Windows victims receive a VBS and NodeJS chain that installs the GolangGhost backdoor, while macOS victims run a Bash chain that drops malicious components, uses FrostyFerret to steal the system password, and then launches GolangGhost for remote control and browser data theft. Sekoia says the campaign focuses on centralized finance targets and may be aimed at less technical crypto employees who are less likely to question the command prompt.