Threats · 51 days ago
Japan, the US, Germany and Australia said WaterPlum, also called Contagious Interview, infected at least 30,000 devices in more than 100 countries and took funds or credentials from more than 7,000 cryptocurrency wallets. The joint advisory also ties the campaign and some North Korean IT workers to the DPRK’s 313 General Bureau.
The lure is a fake recruiting task: victims are pushed to open a project or install a package, and the malicious code runs inside normal developer workflows, including Visual Studio Code and npm-based tasks. Once inside, the operators can steal browser logins, wallet keys and other data, and the same access can reach an employer network if the victim is a developer.
The update today is not only attribution but disruption. Japan’s takedown of the first confirmed North Korean laptop farm shows the operation depends on human-run support infrastructure as well as malware; for organizations that hire developers or accept coding assignments, the exposure sits in recruiting channels and the trusted tools those workflows touch.
6 sources covering this story
North Korean Attackers Hit 30,000 Devices and Steal $10.7m
WaterPlum compromised 30,000 devices and took funds or credentials from 7000 crypto wallets
Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
The US, Japan, Germany and Australia have published a joint report detailing the scope of North Korea’s WaterPlum campaign.
North Korean WaterPlum hackers infected 30,000 devices worldwide
A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea.
North Korea's fake job interviews infected 30,000 devices
WaterPlum recruiters used bogus coding tests to backdoor jobseekers and raid more than 7,000 crypto wallets
International security agencies warned that North Korean hacker group WaterPlum is posing as prospective employers to target job seekers and steal millions in cryptocurrency.
The Record from Recorded Future
The FBI and Defense Department partnered with Japan’s National Police Agency and law enforcement agencies in Australia and Germany on a new advisory about “WaterPlum” — a group of cyber actors allegedly stealing cryptocurrency from job applicants by posing as AI or blockchain companies.
Part of the PlainSec briefing for 2026-09-22