North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto
North Korean WaterPlum actors posed as recruiters to infect 30,000 developers' PCs and steal $10.7M in cryptocurrency via BeaverTail, InvisibleFerret and other malware.
North Korean-linked WaterPlum operators, behind the Contagious Interview campaign, posed as recruiters on job boards and freelance marketplaces to trick developers into running malicious files between December 2025 and July 2026, infecting at least 30,000 computers in over 100 countries. The malware families BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle harvested data from more than 7,000 cryptocurrency wallets, moving at least $10.7 million to North Korea. IC3 tied the activity to North Korean IT workers using 'laptop farms', and Japan dismantled one such site linked to an enabler. Actors reportedly used AI face-swapping during video interviews, and a compromised developer can serve as an entry point into employers' networks.
- 30,000 computers infected across 100+ countries between December 2025 and July 2026
- $10.7 million in cryptocurrency taken from 7,000+ wallets and moved to North Korea
- Malware families include BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle
- StoatWaffle hides in blockchain-themed projects and abuses VS Code tasks.json for execution
- Actors used AI face-swapping in video calls and ran laptop farms; Japan dismantled one
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1656 ImpersonationT1539 Steal Web Session Cookie
- Tags
- beavertailcontagious-interviewcrypto-theftfake-recruiterinvisibleferretnorth-koreastoatwafflewaterplum
- Vendors
- Microsoft
- Products
- Visual Studio Code
- Threat actors
- WaterPlumNorth Korea IT workers
- Organizations
- IC3
- Countries
- North KoreaJapan
From the original article
4 min read at cybersecuritynews.com
North Korean-linked WaterPlum operators have turned job hunting into a route for theft. By posing as recruiters, they persuaded software developers to run harmful files during apparently normal online interviews. The campaign, also known as Contagious Interview, reached at least 30,000 computers in more than 100 countries between December 2025 and July 2026.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.