Lazarus is described using ClickFix social engineering inside the Contagious Interview campaign to target job seekers, especially software developers, through fake recruiter workflows on platforms such as LinkedIn, Telegram, and Discord. Victims are led to fake video-interview sites where a camera-access prompt instructs them to copy and run malicious commands, with payloads varying across macOS, Windows, and Linux and linked to malware families such as BeaverTail, InvisibleFerret, and CivetQ. The hunting workflow pivots from willointerview[.]com and 23.254.244[.]74 to related domains using Validin data such as DNS resolutions, Hostwinds hosting, shared host-meta response features, certificate transparency, lookalike domains, and naming patterns around crypto, hiring, talent, interview, and blockchain themes. The source stresses that pivots can include legitimate Willo infrastructure and must be verified, for example by checking campaign-specific paths, before treating related domains as indicators.