North Korean WaterPlum hackers infected 30,000 devices worldwide
Joint US, Japan, Australia, Germany advisory links North Korean WaterPlum group to 30,000 infected devices and $10.7 million in stolen cryptocurrency.
A joint advisory from Japanese, US, Australian, and German authorities attributes the 'Contagious Interview' campaign to the North Korean WaterPlum group, which infected at least 30,000 devices in over 100 countries between December 2025 and July 2026. Attackers posed as recruiters and AI, crypto, and NFT companies on freelance platforms, delivering BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware via malicious npm packages and Visual Studio Code projects. The group drained funds or credentials from over 7,000 cryptocurrency wallets and transferred 1.7 billion JPY (about $10.71 million) to North Korea. The advisory also ties WaterPlum to DPRK fraudulent IT-worker operations under the 313 General Bureau, noting Japan's police dismantled their first such laptop farm.
- WaterPlum infected 30,000+ devices in over 100 countries and exfiltrated funds or credentials from 7,000+ crypto wallets.
- Malware families include BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle delivered via npm and VS Code projects.
- Victims are targeted through fake job interviews, coding tests, and video-conferencing troubleshooting prompts to run malicious code.
- Actors use AI face-swapping in interviews, pivot to employer networks, and steal identity documents for IT-worker fraud.
- Japan's National Police Agency dismantled its first North Korean IT-worker laptop farm, tracing hundreds of millions of yen abroad.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1195.001 Compromise Software Dependencies and Development ToolsT1056.001 KeyloggingT1115 Clipboard DataT1555.003 Credentials from Web Browsers
- Tags
- beavertailcontagious-interviewcryptocurrency-theftinvisibleferretnorth-koreanpmottercookiewaterplum
- Products
- Visual Studio Code
- Threat actors
- WaterPlum
- Organizations
- FBIJapan National Police Agency
From the original article
3 min read at bleepingcomputer.com
A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10. 7 million in stolen cryptocurrency to North Korea. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.