The Lazarus Group’s Contagious Interview campaign is described as evolving its payload delivery for BeaverTail, InvisibleFerret, and OtterCookie across multiple malicious projects. The analyzed code uses external requests, URL-splitting, Vercel-hosted lure content, axios-based communication, eval-style execution paths, and try/catch error handling to retrieve and run payloads while frustrating static detection. Infrastructure and artifacts cited include fashdefi[.]store on port 6168, bujey[.]store, cdn-static-server[.]vercel[.]app, chainlink-api-v3[.]cloud, a Bitbucket repository, and project/package names tied to malicious delivery. The findings matter because the delivery logic is changing quickly while preserving the campaign’s basic modus operandi, creating pressure on defenses that rely mainly on direct code signatures or pattern matching.