Japan, the US, Germany and Australia said WaterPlum, also called Contagious Interview, infected at least 30,000 devices in more than 100 countries and took funds or credentials from more than 7,000 cryptocurrency wallets. The joint advisory also ties the campaign and some North Korean IT workers to the DPRK’s 313 General Bureau.
The lure is a fake recruiting task: victims are pushed to open a project or install a package, and the malicious code runs inside normal developer workflows, including Visual Studio Code and npm-based tasks. Once inside, the operators can steal browser logins, wallet keys and other data, and the same access can reach an employer network if the victim is a developer.
The update today is not only attribution but disruption. Japan’s takedown of the first confirmed North Korean laptop farm shows the operation depends on human-run support infrastructure as well as malware; for organizations that hire developers or accept coding assignments, the exposure sits in recruiting channels and the trusted tools those workflows touch.
North Korean WaterPlum hackers infected 30,000 devices worldwide
A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea.