North Korean Attackers Hit 30,000 Devices and Steal $10.7m
North Korea's WaterPlum infected about 30,000 devices and stole roughly $10.7 million in cryptocurrency.
A joint advisory from Japan's NPA, the FBI, Australia's ACSC, and German services says WaterPlum, also known as Contagious Interview, infected at least 30,000 devices in more than 100 countries between about December 2025 and July 2026. Actors posed as employers and delivered BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle through malicious NPM packages and Visual Studio Code projects, stealing credentials and wallet keys from over 7,000 cryptocurrency wallets. At least JPY 1.7 billion ($10.7 million) was transferred to North Korea. Agencies link some activity to North Korean IT workers under the 313 General Bureau and say Japan dismantled a laptop farm.
- About 30,000 devices in over 100 countries were infected
- More than 7,000 crypto wallets were looted, totaling about $10.7 million
- Fake interviews pushed malware via NPM packages and VS Code projects
- Japan dismantled a laptop farm tied to North Korean IT workers
- Agencies attribute overlap to the 313 General Bureau
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 User Execution: Malicious FileT1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development ToolsT1056.001 Input Capture: KeyloggingT1113 Screen Capture
- Products
- Visual Studio Codenpm
- Threat actors
- WaterPlumContagious Interview
From the original article
2 min read at infosecurity-magazine.com
WaterPlum compromised 30,000 devices and took funds or credentials from 7000 crypto wallets
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.