North Korean hackers infect thousands of devices across 100 countries as part of ‘WaterPlum’ campaign

FBI and Japanese police advisory ties North Korea's WaterPlum campaign to $10.5M stolen from job seekers via fake-recruiter malware on 30,000 devices.

A joint advisory from the FBI, US Defense Department, Japan's National Police Agency and partners describes 'WaterPlum', North Korean cyber actors posing as AI and blockchain companies to recruit job seekers. Between December 2025 and July 2026 the group infected at least 30,000 devices across 100 countries and stole funds or credentials from about 7,000 cryptocurrency wallets, totaling over $10.5 million. Victims, mostly web designers, engineers and crypto specialists in Japan and elsewhere, were contacted via social media and freelance portals and told to download files during interviews, leading to infection with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle malware plus remote management tools. The campaign is intertwined with DPRK IT-worker laptop-farm schemes and is attributed to North Korea's General Bureau of the Munitions Industry Department; Japanese police disrupted a laptop farm for the first time.