WaterPlum agroup that authorities have linked to North Korea, has infected at least 30,000 devices in more than 100 countries, turning fake job postings for developers into a conduit for cryptocurrency theft. The campaign reveals how easily a recruitment process can escalate into a serious cybersecurity incident.
The data was released on September 18, 2026, in a joint advisory statement by Japan, the United States, Australia and Germany. The German BND reports that WaterPlum is also known as Contagious Interview or Deceptive Development and has been operating worldwide since 2022.
According to BleepingComputer's analysis, the recent phase of the campaign ran from December 2025 to July 2026. Researchers identified the theft of data from approximately 7,000 cryptocurrency wallets and transfers of at least 1.7 billion Japanese yen, or about $10.7 million.
See also: Contagious Interview: The technique of North Korea's fake IT workers
Fake ads: the WaterPlum trap in the hiring process
The perpetrators spread fake ads and pose as representatives of AI, cryptocurrency or NFT companies and reach out to engineers through recruitment networks, social networks and freelance platforms. The candidate is asked to solve a programming test or fix an alleged problem on a video conferencing service.
The critical point is that “testing” often requires running code or opening a project. So a malicious npm package, repository, or Visual Studio Code project can load additional software without the candidate realizing that the infection has begun.
WaterPlum has been linked to BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle. These are tools that can steal browser credentials, clipboard content, keystrokes, documents, screenshots, private keys, and cryptocurrency recovery phrases.
The use of artificial intelligence makes the deception more convincing. In some interviews, operators use face-swapping software and then attribute video or audio problems to network glitches. At the same time, the same infrastructure can be used to move laterally into the networks of employers or clients.
From cryptocurrency theft to corporate network access
The joint statement describes WaterPlum as a state-backed and financially motivated actor and links the fake ads to an organized campaign, possibly affiliated with the 313 General Bureau of North Korea’s Munitions Industry Department. Authorities say the activity is not limited to isolated thefts, but can lead to espionage and intellectual property theft.
Security agencies have also documented instances of North Korean IT workers sharing IP addresses with WaterPlum and reusing stolen identity documents. In Japan, a “laptop farm” linked to such activity was first detected and dismantled.
This model is particularly dangerous for small development teams, where a new contributor can quickly gain access to repositories, service keys, and internal tools. Simply being on a well-known hiring platform is not proof of legitimacy, and demands for immediate code execution should be treated as a red flag.
See also: North Korean hackers abuse VS Code's automated tasks
How developers and companies can protect themselves
Developers should not run unknown code on their main computer, even if it comes from a supposed employer. Testing should be done in an isolated environment or virtual machine, and Visual Studio Code configuration files and package installation commands need to be checked before any execution.
Companies should verify the identity, location, and qualifications of candidates, look for unusual interview patterns, and limit each new hire’s access to strictly necessary systems. The SecNews technical team also recommends separate accounts, multi-factor protection, and immediate credential revocation when suspicious code is executed. Controls should be documented and implemented before the first access to corporate data.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The joint warning is also relevant for Europe, as the BND describes WaterPlum and the activities of North Korean workers as an immediate, short-term threat to citizens and businesses in Germany and other European Union states. Recruitment controls must therefore be combined with technical restrictions.
See also: Lazarus campaign plants malicious npm and PyPI packages
If a computer is already infected, it’s a safe bet that stored credentials have been exposed. You need to isolate the device, change passwords from a clean system, and check cryptocurrency wallets. WaterPlum shows that job hunting is now an attack surface.
