TL;DR
- what: A September 18, 2026 joint advisory from Japanese, US, Australian and German authorities attributes the Contagious Interview campaign to WaterPlum, a crew tied to North Korea's 313 General Bureau, which lures developers through fake job interviews and gets them to run attacker-supplied code.
- impact: At least 30,000 devices across more than 100 countries were infected, credentials or funds were taken from over 7,000 cryptocurrency wallets, and 1.7 billion Japanese yen (10.71 million USD) in crypto moved out of victim accounts between December 2025 and July 2026.
- fix: There is no patch because there is no vulnerability: stop install scripts and editor tasks from auto-executing, run any code sent by a recruiter only in a disposable sandbox, and verify applicant and recruiter identity on both sides of the hiring conversation.
- who: Developers and engineers at AI, cryptocurrency and NFT companies, anyone job hunting on recruiting or freelance platforms, and the employers whose laptops those people also use.
Thirty thousand devices. More than 100 countries. Over 7,000 cryptocurrency wallets with funds or credentials taken. That is the scorecard for WaterPlum, the North Korean group behind the long running Contagious Interview campaign, as tallied in a joint advisory published September 18, 2026 by the Japanese National Police Agency, the FBI and IC3, and Australian and German authorities including the Verfassungsschutz. In Japan alone, investigators tracked 1.7 billion yen, roughly 10.71 million US dollars, leaving victim wallets between December 2025 and July 2026.
None of that started with a zero day. It started with a recruiter. Someone reached out about a role at an AI startup, a crypto exchange, an NFT platform. The company looked real because the attackers built it to look real. The candidate did what candidates do: they were flattered, they were eager, and when the interviewer said the video call was glitching and shared a fix, they ran it.
The interview is the intrusion
The advisory describes an operation built entirely around the hiring funnel. WaterPlum operators impersonate legitimate AI, cryptocurrency and NFT companies and work through recruiting and freelance platforms. The technical assessment stage is where the compromise happens. Candidates are told to clone a project and get it running, or to troubleshoot a broken video conferencing session, or simply to execute a snippet the interviewer pastes into chat. Each of those is a completely normal request during a developer interview. That is the point.
Once code runs, the collection is broad: browser credentials, clipboard contents, keystrokes, cryptocurrency private keys and seed phrases, documents and screenshots. A developer laptop is a rich target precisely because it holds both personal wallets and corporate access, and job hunting is one of the few activities people deliberately keep off their employer's radar. Nobody reports a suspicious recruiter to the SOC while they are still hoping the offer comes through.
Five malware families, one delivery story
The advisory links five families to WaterPlum, and the spread across languages and ecosystems shows how much engineering is behind this:
- BeaverTail, JavaScript malware delivered inside npm packages
- InvisibleFerret, a Python based backdoor used for follow on access
- OtterCookie, a JavaScript remote access trojan and information stealer
- OtterCandy, which merges OtterCookie's stealing with full RAT capability
- StoatWaffle, modular Node.js malware delivered through malicious Visual Studio Code projects
The payload is the job — Every one of these families arrives inside something a developer was asked to open: a package, a repository, a project folder. There is no exploit to patch and no CVE to track. The vulnerability being exercised is the professional obligation to run the code you were handed.
This is a state revenue line, not a hobby
The advisory attributes WaterPlum to the 313 General Bureau, part of North Korea's Munitions Industry Department. That placement matters. This is not an intelligence collection unit that happens to steal crypto on the side. It sits inside the apparatus that funds weapons production, which means the operation is measured in money moved and will be resourced accordingly. Eight months of activity, 30,000 devices and five maintained malware families is what a funded product team looks like, not what an opportunistic crew looks like.
The RedEye take
The security industry spent years telling users not to click links in email, and largely won that fight. We never had the equivalent conversation about code, because telling a developer not to run unfamiliar code sounds like telling them not to do their job. WaterPlum found that gap and industrialized it. Thirty thousand devices is not a phishing success rate, it is an indictment of how much implicit trust rides on a package.json, a repository clone and a screen share.
There is also an uncomfortable organizational truth in these numbers. Most of these compromises happened on machines during personal time, on personal ambition, using the same laptop that holds the corporate VPN certificate. Security programs have no visibility into the job search, and the deliberate secrecy around interviewing means the victim is motivated to stay quiet even after something feels wrong. Any control that depends on the employee volunteering that they were talking to a recruiter is a control that does not exist. Build for the case where they never tell you, and make the safe path, a disposable sandbox for any code that arrives from outside, faster to use than the unsafe one.
What defenders should learn
- Treat package install scripts as arbitrary execution, because they are. Setting ignore-scripts across developer machines removes BeaverTail's easiest path from clone to code execution and costs almost nothing in daily friction.
- Audit your editors, not just your endpoints. StoatWaffle ships inside Visual Studio Code projects, and a workspace task configured to run when the folder opens executes before a human reads a single line. Hunt for that configuration across your fleet today.
- Give engineers a sanctioned throwaway environment for outside code, and make it a one command action. The advisory's own guidance is to avoid running unknown code outside a sandbox, which only works if the sandbox is already there when curiosity strikes.
- Verification is bidirectional. The advisory tells employers to verify applicant identity, location and qualifications, but this campaign inverts that: your staff need a way to verify the company that is recruiting them. Say out loud that checking a recruiter is normal and not disloyal.
- Assume personal crypto compromise becomes corporate compromise. Over 7,000 wallets were hit by malware that also takes browser credentials and keystrokes. When an employee reports a drained personal wallet, that is an incident ticket, not a sympathy card.
⚠️ No patch is coming — Do not wait for a fixed version, because there is not one. The only levers you control are execution defaults on developer machines, sandboxing, and a culture where an engineer can say "a recruiter sent me a repo" without it being awkward.
Source
Reporting and figures from BleepingComputer, "North Korean WaterPlum hackers infected 30,000 devices worldwide," covering the joint advisory issued September 18, 2026 by Japanese, US, Australian and German authorities.
Originally published on RedEye Threat Intelligence.
Top comments (0)