SentinelLABS Reveals How North Korean “Contagious Interview” Operators Abuse Threat Intel Platforms

The SentinelLABS intelligence team, in collaboration with Validin, published an in-depth analysis of North Korean-aligned actors exploiting cyber threat intelligence platforms to monitor their exposure, scout new infrastructure, and refine operations, according to SentinelLABS. The report links the Contagious Interview campaign to the Lazarus umbrella cluster and notes the use of the ClickFix social engineering technique to compromise victims.

Between March and June 2025, researchers observed Contagious Interview operators registering accounts on Validin just hours after the platform published a blog post about Lazarus infrastructure, with Gmail accounts tied to previous operations suggesting deliberate coordination. They persisted despite blocks, moving to new domains such as versusx[.]us and quiz-nest[.]com to regain access, and used Slack for real-time collaboration with CTI searches shared across accounts.

Log files exposed by Contagious Interview infrastructure revealed over 230 victims between January and March 2025, with targets mainly in the cryptocurrency and blockchain sectors in roles such as Portfolio Manager and Senior Product Manager, impersonating firms including Robinhood, Archblock, and eToro. This activity aligns with North Korea’s broader strategy of cyber operations to generate revenue for sanctions evasion and weapons development.