11
A North Korea-linked cyber group has compromised at least 30,000 devices across more than 100 countries by posing as recruiters and targeting software developers and other IT
professionals, according to a joint advisory issued by cybersecurity and law-enforcement agencies from the United States, Japan, Australia and Germany.
The group, identified as WaterPlum and also known as Contagious Interview, allegedly approached victims with fake employment opportunities, often impersonating recruiters or companies operating in areas such as artificial intelligence, cryptocurrency and Web3.
The campaign was active from approximately December 2025 through July 2026, according to the advisory. Authorities said the attackers obtained funds or account credentials associated with more than 7,000 cryptocurrency wallets and transferred cryptocurrency worth about 1.7 billion Japanese yen, or $10.71 million, to North Korea.
The attackers reportedly contacted potential victims through social media, online job platforms, gig-work services and freelance marketplaces. After establishing contact, they could invite candidates to virtual interviews or provide technical assignments as part of the recruitment process.
In some cases, candidates were instructed to download a coding project, software package or other file and run it on their computers. Authorities said these files could contain malicious code that provided attackers with access to the victim's device.
The advisory identifies several malware families associated with the campaign, including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle.
Once a device was compromised, attackers could collect information such as browser credentials, files, screenshots, clipboard contents, keystrokes and cryptocurrency-wallet information.
The threat could also extend beyond individual developers. According to the advisory, a compromised computer belonging to an IT professional could potentially provide attackers with access to an organisation's systems, creating risks involving corporate credentials, intellectual property and other sensitive information.
Authorities said the campaign particularly targeted web designers, engineers and professionals working in cryptocurrency, blockchain and Web3.
The use of recruitment processes as an entry point makes the campaign notable because the malicious activity can initially resemble a normal technical interview or coding assessment. The advisory therefore recommends that developers avoid running code received from unknown sources on systems containing sensitive information.
Security agencies also recommend using isolated environments such as virtual machines or sandboxes when testing unfamiliar code and checking suspicious Visual Studio Code projects before executing them.
The campaign highlights the security risks associated with downloading and executing third-party code during remote recruitment processes. For developers and technology companies, verifying recruiters, employers and technical assignments can form an additional layer of protection against such attacks.
The group, identified as WaterPlum and also known as Contagious Interview, allegedly approached victims with fake employment opportunities, often impersonating recruiters or companies operating in areas such as artificial intelligence, cryptocurrency and Web3.
The campaign was active from approximately December 2025 through July 2026, according to the advisory. Authorities said the attackers obtained funds or account credentials associated with more than 7,000 cryptocurrency wallets and transferred cryptocurrency worth about 1.7 billion Japanese yen, or $10.71 million, to North Korea.
The attackers reportedly contacted potential victims through social media, online job platforms, gig-work services and freelance marketplaces. After establishing contact, they could invite candidates to virtual interviews or provide technical assignments as part of the recruitment process.
In some cases, candidates were instructed to download a coding project, software package or other file and run it on their computers. Authorities said these files could contain malicious code that provided attackers with access to the victim's device.
The advisory identifies several malware families associated with the campaign, including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle.
Once a device was compromised, attackers could collect information such as browser credentials, files, screenshots, clipboard contents, keystrokes and cryptocurrency-wallet information.
The threat could also extend beyond individual developers. According to the advisory, a compromised computer belonging to an IT professional could potentially provide attackers with access to an organisation's systems, creating risks involving corporate credentials, intellectual property and other sensitive information.
Authorities said the campaign particularly targeted web designers, engineers and professionals working in cryptocurrency, blockchain and Web3.
The use of recruitment processes as an entry point makes the campaign notable because the malicious activity can initially resemble a normal technical interview or coding assessment. The advisory therefore recommends that developers avoid running code received from unknown sources on systems containing sensitive information.
Security agencies also recommend using isolated environments such as virtual machines or sandboxes when testing unfamiliar code and checking suspicious Visual Studio Code projects before executing them.
The campaign highlights the security risks associated with downloading and executing third-party code during remote recruitment processes. For developers and technology companies, verifying recruiters, employers and technical assignments can form an additional layer of protection against such attacks.
