North Korean WaterPlum campaign infected 30,000 devices via fake job interview tasks

What happened

Government agencies in Japan, the United States, Australia and Germany have issued a joint advisory describing a North Korean cyber campaign that infected at least 30,000 devices across more than 100 countries between December 2025 and July 2026. According to a summary of the advisory published on dev.to, the document was released on September 18, 2026 by Japan's National Police Agency and NCO, the FBI and DC3, Australia's ASD's ACSC, and Germany's BND and BfV.

The operators are tracked as WaterPlum and are better known as Contagious Interview. The agencies report that credentials or assets were taken from more than 7,000 cryptocurrency wallets during the same period, and that cryptocurrency worth at least 1.7 billion yen was moved to North Korea.

How the attack unfolds

The campaign starts with approaches to developers and other IT workers through social media, job boards and freelance marketplaces. Posing as recruiters or staff at fictitious AI and cryptocurrency companies, the attackers invite targets to an online interview or a coding exercise. The assignment requires downloading and running files hosted in code repositories or collaborative development services.

The payload arrives mainly as malicious npm packages. A component the advisory calls StoatWaffle is also delivered through Visual Studio Code projects whose tasks run automatically once the user trusts the workspace. Once executed, the malware deploys remote access trojans and information stealers that harvest browser credentials, clipboard contents, keystrokes, screenshots, wallet data and identity documents.

Persistence is the goal. The dev.to summary notes that stolen credentials and standing access create openings to compromise the companies or contractors where victims work, though the advisory does not disclose how many corporate intrusions actually resulted.

The attributed toolset

The advisory names five malware families tied to the operation: BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle. The NPA and FBI assess that WaterPlum actors, together with some North Korean IT workers, operate under the 313 General Bureau of the Munitions Industry Department, which answers to the Central Committee of the Workers' Party of Korea.

A parallel track of fraudulent IT workers

Separately, the agencies describe North Korean IT workers obtaining positions at companies in Japan, the United States and Europe under invented identities. The dev.to write-up lists fabricated resumes, VPNs, AI-assisted face, voice and translation support, and laptop farms run by local accomplices as the tools of this scheme, which aims at both corporate access and salaries. This activity does not always overlap with the malware infections described above.

What defenders can watch for

To a victim, the operation looks like an attractive job offer, a technical interview, a code-fix assignment or troubleshooting help for a video call. To administrators, the warning signs include npm packages from unapproved sources, execution of code pulled from external repositories, newly trusted VS Code workspaces, unfamiliar Node.js or Python processes, and heavy access to browser data or cryptocurrency-related files.

The recommended mitigations centre on isolation and verification: run recruitment tasks inside sandboxes, keep personal devices that touch corporate resources separate, enforce least privilege, and check candidates' identity, location, IP addresses and payment destinations through multiple independent channels.

Why it matters

The campaign converts a routine part of technical hiring, the take-home coding task, into a code-execution vector, and it does so at industrial scale. Every developer who runs unfamiliar code in hopes of landing a job is a potential entry point, and when that first execution happens on a personal machine, the employer often has no log of it at all. With tens of thousands of devices already compromised and wallet thefts funnelling funds to a sanctioned state, the advisory reads less like a warning about a novel technique and more like a reminder that the weakest link in the software supply chain may be the candidate eager to impress.