North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto

North Korean-linked WaterPlum operators have turned job hunting into a route for theft. By posing as recruiters, they persuaded software developers to run harmful files during apparently normal online interviews.

The campaign, also known as Contagious Interview, reached at least 30,000 computers in more than 100 countries between December 2025 and July 2026.

The attackers obtained funds or account credentials from more than 7,000 cryptocurrency wallets and moved at least $10.7 million in cryptocurrency to North Korea.

Analysts at the Internet Crime Complaint Center, or IC3, noted the pattern in guidance on North Korean IT-worker activity.

IC3 said in a report shared with Cyber Security News (CSN) that trusted hiring steps can be exploited to place malware on systems holding data.

The operation also creates a second danger: a compromised developer can become an entry point to an employer or client.

Stolen browser logins, wallet keys, identity documents, screenshots and project files can support further theft, extortion or access to corporate networks.

North Korean WaterPlum Hackers Infect 30,000 PCs

WaterPlum approaches targets through social networks, job boards, gig sites and freelance marketplaces. It impersonates employers, then asks candidates to complete a coding task or resolve a supposed problem with interview software.

Instead of a legitimate assignment, the target is directed to download and execute a malicious project, package or file. This approach resembles fake recruiter coding tests, where an everyday technical assessment becomes the delivery mechanism.

The files can carry BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle. Those tools give operators a foothold, maintain remote access and steal information.

StoatWaffle can be hidden inside blockchain-themed projects and use a Visual Studio Code configuration to run code when a victim opens and trusts the folder.

WaterPlum members reportedly used AI face-swapping during video calls. That tactic makes the warning in this fake Web3 interview case relevant: a polished recruitment process does not make a download safe.

The impact extends beyond an individual wallet. Credentials taken from a developer can expose an employer, client or contractor to intellectual-property theft and wider network intrusion.

Stolen identity images may also help North Korean IT workers impersonate victims while seeking contracts and foreign income.

Laptop Farms Broaden Risk

Authorities linked parts of this activity to North Korean IT workers who obtain work under false identities. They use “laptop farms,” locations where computers are set up for remote control, plus virtual private servers and local enablers, to conceal where the work is actually performed.

Japan dismantled a laptop farm connected to an enabler, according to the advisory. Investigators found WaterPlum actors and suspected IT workers used the same IP addresses when accessing laptop farms, using crowdsourcing services and applying for a position at a Japanese cryptocurrency exchange.

Employers should treat unusual recruitment details as a security concern, not merely a hiring issue. Useful checks include confirming contact details, asking applicants to explain their experience in depth and being alert when claimed skills, location, language ability or payment requests do not fit.

Recent reporting on North Korean worker deception shows how stand-ins and remote-control tools can obscure who is behind a screen.

For candidates, the central rule is simple: never run unknown code on a personal device or a machine that holds cryptocurrency, sensitive data or workplace access.

Test untrusted projects only in an isolated environment, inspect them for unreadable or disguised content, and avoid opening unfamiliar Visual Studio Code projects outside Restricted Mode.

If infection is suspected, immediately disconnect the device from the internet. Because wallet data may already be exposed, create a replacement wallet on a separate device, move assets, store its seed phrase offline, back up necessary files and fully reset the system. Organisations should limit contractor access and revoke accounts and sessions quickly when concerns arise.

This campaign builds on a long-running threat to developers: attackers know a promising role can make a risky download appear routine.

Readers can compare its method with Contagious Interview malware campaign, which likewise used a fake hiring process to deliver credential-stealing software.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Malware family	BeaverTail	JavaScript-based malware delivered through malicious packages and developer projects
Malware family	InvisibleFerret	Python-based backdoor used to access compromised systems
Malware family	OtterCookie	JavaScript remote-access and information-stealing malware
Malware family	OtterCandy	Malware combining OtterCookie and RATatouille capabilities
Malware family	StoatWaffle	Modular Node.js loader, credential harvester and remote-access malware
File name	.vscode/tasks.json	Visual Studio Code task configuration file that can trigger malicious code execution when an unsafe project folder is trusted
Suspicious command string	curl	Command string cited by the advisory as a warning sign in untrusted scripts
Suspicious command string	base64	String that can indicate encoded or concealed script content
Suspicious command string	-enc	Common encoded-command parameter cited in the advisory
Suspicious command string	mshta	Script execution utility cited as a suspicious string in unknown commands
Suspicious command string	Invoke-WebRequest -Uri	Download command pattern that should be reviewed before execution
Suspicious command string	iwr -uri	Shortened download-command pattern cited in the advisory
Suspicious command string	hidden	String that can indicate an attempt to conceal command execution

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC