ThreatBook reports that Lazarus is still running cryptocurrency theft operations through fake job offers and project opportunities on LinkedIn, X, Facebook, GitHub, Stack Overflow, and related recruiter channels. Victims are pushed toward malicious cryptocurrency projects or fake video-conferencing software such as the forged FCCCall installer, which launches a QT6-based stealer while showing a legitimate-looking conference window. The Windows sample connects to 185.235.241[.]208:1224, uploads browser wallet data, downloads a Python environment and main99.py, then retrieves payloads for host reconnaissance, file theft, browser credential theft, clipboard and window monitoring, keylogging, shell access, and AnyDesk configuration. The excerpt says Lazarus uses lightweight Python and JavaScript tooling across Windows, Linux, and macOS, with active infrastructure and IOCs still available for detection.