WaterPlum compromises 30,000 devices through fake interviews

North Korean cyber operators posing as recruiters have compromised at least 30,000 devices in more than 100 countries, using fraudulent job interviews to infect technology professionals and steal cryptocurrency, authorities from four countries have disclosed.

The campaign, attributed to a group tracked as WaterPlum and widely known as Contagious Interview, targeted web designers, software engineers, freelancers and specialists in cryptocurrency, blockchain and Web3 technologies between about December 2025 and July 2026.

Investigators said the attackers extracted funds or account credentials from more than 7,000 cryptocurrency wallets and transferred at least 1.7 billion yen, equivalent to about $10.71 million, in cryptocurrency to North Korea.

The findings were released jointly by Japan’s National Police Agency and National Cybersecurity Office, the US Federal Bureau of Investigation and Department of Defense Cyber Crime Center, the Australian Signals Directorate’s Australian Cyber Security Centre, and Germany’s Federal Intelligence Service and Federal Office for the Protection of the Constitution.

Japan’s police and the FBI assess that WaterPlum operators and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, which is subordinate to the Central Committee of the Workers’ Party of Korea.

WaterPlum’s method centres on ordinary-looking recruitment approaches. Operators contact job seekers through social networks, online employment sites, gig platforms and freelance marketplaces while impersonating legitimate artificial intelligence, cryptocurrency or non-fungible-token companies.

Targets are invited to online technical interviews or asked to complete coding assignments. During the process, the supposed recruiter instructs applicants to download and execute files hosted on software-development platforms or code repositories, sometimes telling them the files are needed to complete a task or fix a video-conferencing problem.

Those downloads can contain malicious Node Package Manager packages carrying malware families identified as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle. Once installed, the tools can create backdoor access and deploy remote-access trojans and information stealers, allowing attackers to maintain control of compromised systems.

Authorities said the malware can harvest browser-stored usernames and passwords, clipboard contents, keystrokes, screenshots, cryptocurrency wallet private keys and seed phrases, as well as identity documents and other files stored locally or in shared folders.

The access can also create risks beyond an individual victim. Investigators warned that credentials stolen from developers may provide a path into employers, clients or contracting organisations, exposing corporate information, source code and intellectual property to theft or extortion.

The advisory also links WaterPlum activity with North Korea’s separate use of disguised IT workers seeking legitimate contracts abroad. Investigators found overlapping infrastructure, including shared internet addresses used to access so-called laptop farms, cloud-based services and employment applications.

Laptop farms typically consist of computers placed at an intermediary’s residence or another location and remotely controlled by North Korean IT workers. Such arrangements can make workers appear to be operating from a country where they are not physically present and can help conceal their origin while they obtain contracts and payments.

Japanese authorities said they had, for the first time, identified, investigated and dismantled such a laptop farm in Japan. Evidence collected in related inquiries indicated that North Korean IT workers transferred several hundred million yen abroad, including cryptocurrency assets.

Investigators also described a May 2025 application to a Japanese cryptocurrency exchange by a person suspected of being a North Korean IT worker. The applicant used a virtual private network and submitted a résumé claiming an unusually broad range of technical skills and work experience across several countries. The company declined to hire the applicant after detecting inconsistencies, and no damage occurred.

Investigators said WaterPlum operators have also used artificial-intelligence face-swapping software during interviews, sometimes disabling video after a few minutes and citing connection problems. The advisory said the actors continually refine their techniques, making verification of recruiters and downloaded code important.