The Contagious Interview sample analyzed by dmpdump used fake Willo candidate-screening sites to lure victims into running a copied shell command. The shared VCam_intel.zip artifact contained Windows, macOS and Linux material, with macOS scripts downloading architecture-specific payloads from api.nvidia-cloud[.]online, unpacking them under /var/tmp/VCam and installing a LaunchAgent at ~/Library/LaunchAgents/com.vcam.plist. The vcamservice.sh script built and ran a Golang payload from app.go, which generated a victim ID, checked for duplicate execution and contacted http://216.74.123[.]191:8080. The activity fits North Korea-nexus Contagious Interview tradecraft aimed at crypto-wallet theft through job-interview lures and cross-platform tooling.