WaterPlum Hit 30,000 Devices via Fake Job Interviews

The recruiter was friendly, the company had a real looking website, and the take home assignment was a normal looking repository. Then the video call froze, the interviewer suggested a quick fix for the conferencing plugin, and the candidate pasted a command into their own terminal. Thirty thousand people did some version of that between December 2025 and July 2026.

Key Takeaways

• WaterPlum infected at least 30,000 devices in more than 100 countries between around December 2025 and July 2026, according to the September 18, 2026 joint advisory published by Japan's National Police Agency.
• The group drained funds or credentials from over 7,000 cryptocurrency wallets and moved 1.7 billion Japanese yen, about 10.71 million USD, to the DPRK.
• Japan's NPA and the FBI assess that WaterPlum operates under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers Party of Korea.
• Five malware families carried the payload: BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle, delivered inside npm packages and Visual Studio Code projects.
• Every infection started with a human conversation, not an exploit: a recruiter message, an interview, and an instruction to run something.

What Is WaterPlum?

WaterPlum is the name six government agencies have now agreed on for the threat group the security industry has been calling Contagious Interview since 2023. The advisory is signed by Japan's National Police Agency and National Cybersecurity Office, the FBI and the US Department of Defense Cyber Crime Center, the Australian Signals Directorate's Australian Cyber Security Centre, and Germany's Federal Intelligence Service and Federal Office for the Protection of the Constitution. The FBI also lists it among its industry alerts.

The attribution line is the part worth reading twice. The NPA and FBI place WaterPlum, and some of the North Korean IT workers who apply for real jobs at real companies, under the same parent: the 313 General Bureau of the Munitions Industry Department. The advisory notes that both sets of operators used the same IP addresses when accessing laptop farms and when applying for positions at a Japanese cryptocurrency exchange. Stealing wallets and getting hired are two revenue lines from one office.

Japanese authorities also report a first: they dismantled a laptop farm run by an enabler inside Japan, and obtained evidence that several hundred million yen in cryptocurrency left the country through it.

How Does the Contagious Interview Lure Work?

The lure is a job offer that never ends in a job. WaterPlum actors pose as prospective employers, usually impersonating AI, cryptocurrency or NFT companies, and reach targets through social media, online job boards, gig platforms and freelance marketplaces. The advisory is specific about who they want: individual web designers, engineers, and specialists in cryptocurrency, blockchain and Web3.

Once a candidate engages, the funnel has two branches, and both end with the target executing attacker code on their own machine:

• The coding assignment. A technical take home hosted on a normal developer platform or code repository. The repo runs, the malware runs with it.
• The broken video call. Mid interview the conferencing platform develops an error, and the interviewer walks the candidate through a fix. The fix is the payload. We covered the same pattern when fake job interviews were used to harvest Google logins earlier this year.

The tradecraft is scrappier than the numbers suggest. Investigators observed WaterPlum members running interviews through AI face swapping software, then killing their video after a few minutes and asking the target to do the same, citing network problems. Other logged behaviors: practicing Japanese pronunciation with text to speech tools, sticking to free tiers of AI services, and going quiet on North Korean holidays to watch soccer.

Which Malware Families Are Involved?

The advisory names five, all delivered through malicious npm packages or repositories rather than through an exploit:

• BeaverTail — JavaScript malware hidden inside npm packages, downloadable from GitHub or Bitbucket.
• InvisibleFerret — a Python based backdoor into the victim's network.
• OtterCookie — a JavaScript remote access trojan and infostealer.
• OtterCandy — a hybrid combining OtterCookie's features with RATatouille.
• StoatWaffle — a modular Node.js family bundling a loader, credential harvesting components and a RAT.

StoatWaffle is the one that should worry anyone who clones repositories for a living. Per the advisory, it hides in blockchain themed project repositories and embeds a malicious Visual Studio Code configuration file that triggers auto run code execution the moment the folder is opened and trusted. No build step, no script invocation, no click. We wrote about that execution path in March, when it was a vendor report rather than a signed government assessment.

After the loader lands, the pattern is conventional: RATs for persistence and lateral movement, infostealers to pull wallet material and sensitive data out to a command and control address. The registry itself is the distribution channel, which puts this campaign alongside the npm poisoning runs we tracked when North Korea compromised 141 packages through Mastra AI.

What the Numbers Actually Say

Most coverage of this advisory leads with the 10.71 million USD. That is the least interesting number in the document. Spread across more than 7,000 drained wallets, the haul works out to roughly 1,530 USD per wallet — this was not a hunt for whales, it was a dragnet over freelancers. And 10.71 million is under four percent of what the same regime took in a single afternoon when it walked 280 million dollars out of Drift Protocol without exploiting a bug.

So why burn eight months and 30,000 endpoints for a rounding error? Because the crypto is a byproduct. The advisory is blunt about the follow on damage: stolen IDs let North Korean IT workers impersonate real people to get hired, and stolen credentials get leveraged to pull crypto, personal data and trade secrets out of the victim's employer, clients and contracting parties — or to extort them. Every compromised freelancer is a reusable identity and a live credential set pointed at somebody else's corporate network.

Read that way, 30,000 devices in 100 plus countries is not the damage total. It is the inventory.

Why This Lands in Your Inbox and DMs

Nothing in this campaign is an exploit. There is no CVE, no drive by, no zero day. The entire access chain runs on messages that arrive where you already read messages: a LinkedIn DM, a recruiter email, a Telegram or Discord handoff, a calendar invite with a conferencing link. The technical payload only gets to run because a conversation persuaded somebody to run it.

That makes the recruiting approach itself the control point, and it is a hard one to defend. A fake recruiter pitch looks structurally identical to a real one: cold, flattering, in a hurry, and asking you to open a repository and join a video call with a stranger. The BleepingComputer writeup of the advisory makes the same point: the targeting is aimed at people, through the channels people use for work.

If this works on 30,000 developers through LinkedIn, freelance marketplaces and inbox recruiting, it works on anyone whose job requires talking to strangers who send links. The lure changes, the mechanism does not.

What to Never Run From an Interview Coding Test

The advisory's mitigations for individuals are unusually concrete, and worth following even when the recruiter is real:

• Never execute third party code on a machine that touches your wallets or personal data. Run unknown code in a sandbox or virtual machine, and check for obfuscated or unreadable sections first.
• Treat a mid interview troubleshooting step as a stop sign. No legitimate employer needs you to paste a command to fix their video call.
• Watch for specific strings. The advisory calls out curl, base64, -enc, mshta, iwr -uri and hidden in supplied commands or scripts.
• Open unknown VS Code projects in Restricted Mode. Answer "No" to the "Do you trust the author of the files in this folder?" prompt; that blocks execution of .vscode/tasks.json on launch. Inspect that file before trusting anything, and do not open unknown projects inside a folder path you already marked trusted.
• If you suspect compromise, assume exfiltration already happened. Disconnect the device, create a new wallet on a separate machine, move the assets, store the new seed phrase offline, back up your data and fully reset the operating system.

On the hiring side, the advisory lists tells drawn from interviews with suspected North Korean IT workers: refusals to meet in person, requests for payment in cryptocurrency or to an account in another person's name, frequent glances at a second monitor, background voices, and repeated video or audio freezes. In the one case study included, a Japanese cryptocurrency exchange caught an applicant in May 2025 whose resume claimed over ten items of experience in each of several unrelated stacks and whose spoken English could not support any of it. They did not hire him. Companies should also deploy endpoint detection and response tooling, which CISA has recommended against DPRK activity for years.

Looking Ahead

Six agencies across four countries signing one document is the real escalation, more than any statistic in it. Contagious Interview has been reported by vendors for roughly three years; this is where it gets a state attribution, a bureau number, and a dismantled laptop farm attached to it. The advisory itself closes by warning that the techniques it describes are only examples and that the actors keep refining them.

Expect the next iteration to look less like a repository and more like a conversation. The face swapping gets better, the fake companies get longer histories, the troubleshooting step sounds more plausible. The defense does not change: nothing a stranger sends you runs on the machine that holds your keys.