North Korean WaterPlum group infects 30,000 devices worldwide

The intelligence agencies of Japan, the United States, Australia and Germany have issued a joint alert about the activities of the North Korean hacking group WaterPlum. According to their findings, between December 2025 and July 2026 the attackers compromised at least 30,000 devices across more than 100 countries and funnelled 1.7 billion yen worth of crypto assets — roughly $10.71 million — into North Korea. Funds or credentials were stolen from more than 7,000 crypto wallets.

The interview as bait

WaterPlum is linked to the long-running "Contagious Interview" campaign aimed at job seekers. The attackers pose as legitimate companies in the AI, cryptocurrency and NFT sectors, or operate through recruiting and freelance platforms. During the fake interviews and test assignments, the victim is asked to download a project, "troubleshoot" a video call, or run malicious code.

One detail betrays the scammers' ingenuity: during online interviews they use face-swapping software, then turn off the camera, blaming network problems.

The malware arsenal

The alert lists several malware families: BeaverTail (a JavaScript malware in npm packages), the Python backdoor InvisibleFerret, the remote access trojan OtterCookie and the related OtterCandy, as well as the modular Node.js-based StoatWaffle, which is delivered through malicious Visual Studio Code projects and executes code once a folder is opened and "trusted."

Once inside a system, the attackers steal browser credentials, clipboard contents, keystrokes, private keys and seed phrases from crypto wallets, and documents, and take screenshots. Access to the infected machines can be used to penetrate the networks of employers and clients — up to and including intellectual property theft and espionage.

The link to "remote IT workers"

The agencies directly link WaterPlum to the well-known scheme involving fake North Korean IT specialists: some of the hackers themselves moonlight as remote web developers, and both groups used the same IP addresses. Documents stolen during the attacks are then reused to get hired under someone else's name.

According to the FBI and Japanese police, the members operate within the 313^th General Bureau, part of the structure responsible for the country's defence development. In Japan, a North Korean IT workers' "laptop farm" was identified and shut down for the first time, revealing traces of several hundred million yen transferred abroad.

Companies are advised to carefully verify the identity, location and qualifications of applicants and to limit their access, while developers are urged not to run unfamiliar code outside a sandbox and to check submitted files for commands that download additional modules.

Source: Bleeping Computer