preferred on
Points of Focus
- WaterPlum infected 30,000+ devices and compromised credentials or funds from more than 7,000 crypto wallets.
- The North Korean-linked group used fake job interviews and malicious coding tasks to steal sensitive data and cryptocurrency.
- EtherHiding helps the campaign hide malware commands on blockchains, making the attacks harder to shut down.
Fake North Korean recruiters infected at least 30,000 devices in over 100 countries from about December 2025 to July 2026. Seven agencies in Japan, the United States, Australia, and Germany issued a joint advisory on Sept. 18 on the group WaterPlum.
The group exfiltrated credentials or funds from more than 7,000 cryptocurrency wallets, the advisory says. Wallets it controls received cryptocurrency worth at least 1.7 billion Japanese yen ($10.71 million), according to Japan’s National Police Agency (NPA).
The NPA and the Federal Bureau of Investigation assess that WaterPlum operates under North Korea’s 313 General Bureau of the Munitions Industry Department. Germany’s intelligence agency BND calls WaterPlum, also known as Contagious Interview, almost certainly state-sponsored and financially motivated, active since 2022.
North Korean cyber group “WaterPlum” (aka “Contagious Interview”) is compromising job seekers’ computer networks, harvesting sensitive data, and stealing cryptocurrency. WaterPlum is targeting IT professionals in Japan, the United States, Europe, and beyond.
Posing as… pic.twitter.com/V9NKurMICb
— FBI Cyber Division (@FBICyberDiv) September 18, 2026
Coding tests and video-call fixes carried the malware
WaterPlum posed as AI, cryptocurrency, and non-fungible token employers and contacted developers via social media, job boards, and freelance marketplaces. Interviewers told candidates to run malicious files from code repositories, framed as a coding task or a video-call fix.
Malicious “npm” packages carried the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware families. StoatWaffle arrives inside blockchain-themed Visual Studio Code projects and runs automatically once a victim opens and trusts the folder.
Remote-access trojans maintain access while infostealers exfiltrate data such as browser credentials, keystrokes, screenshots, seed phrases, and ID images. The advisory warns that infections can also give WaterPlum a route into developers’ employers, enabling espionage, intellectual property theft, and lateral movement within corporate workplaces. The BND adds that some WaterPlum infection chains use GitHub or blockchains such as Ethereum to conceal activity.
The group was renamed yet again.
The North Korean "WaterPlum" cyber actor group (commonly referred to as “Contagious Interview”) conducts cyberattacks by infiltrating unsuspecting job seekers’ computer networks, harvesting sensitive information, and stealing cryptocurrency.… pic.twitter.com/aUwTRu039y
— blackorbird (@blackorbird) September 19, 2026
Shared IP addresses link WaterPlum to North Korean IT workers
Japan dismantled its first known laptop farm, where a local enabler hosted PCs controlled remotely by North Korean IT workers. Investigators said such workers transferred several hundred million yen abroad, including cryptocurrency.
WaterPlum and the North Korean IT workers used the same IP addresses to access laptop farms, crowdsourcing services, and a job application at bitFlyer, a Japanese cryptocurrency exchange. In May 2025, bitFlyer rejected a suspected North Korean applicant using a forged resume; no damage occurred. Agencies advise sandboxing unknown code and moving funds to a new wallet on a separate device after suspected infection.
The $10.71 million is only part of the story
The advisory doesn’t specify how many of the 7,000 wallets lost funds. Chainalysis attributes at least $2.02 billion in crypto thefts in 2025 to North Korea in its 2026 Crypto Crime Report, including the FBI-attributed $1.5 billion Bybit hack. The company estimates that North Korea has stolen at least $6.75 billion worth of cryptocurrency cumulatively through 2025, although it says less visible activity may have gone undetected.
Our latest research shows how North Korean and Iranian hackers are increasingly launching hard-to-stop cyberattacks. And they’re using blockchains to do it.
We call the attack tactic “Blockchain Dead Drops,” or BDDs. BDDs are getting more sophisticated, more prevalent, and… pic.twitter.com/mBx8EyMmQ8
— Chainalysis (@chainalysis) September 17, 2026
Four days earlier on Sept. 17, Chainalysis described operators pairing fake interviews with EtherHiding, a technique that stores command data in public-chain smart contracts, letting campaigns outlast takedowns. Google has been tracking a North Korean actor using EtherHiding in the Contagious Interview campaign since February 2025.
Share
Most read articles
