North Korean 'WaterPlum' Hackers Infected 30,000 Devices in Fake Job Scheme

Police and cybersecurity agencies in Japan, the United States, Australia and Germany issued a joint advisory this month warning that a North Korean hacking group has infected at least 30,000 devices in more than 100 countries by posing as recruiters and tricking software developers into running malicious code during fake job interviews. The group, tracked as "WaterPlum" and more widely known as "Contagious Interview," has siphoned cryptocurrency and credentials from more than 7,000 wallets and funneled roughly $10.7 million to North Korea since December 2025.

The advisory, published by Japan's National Police Agency, the FBI, Australia's Cyber Security Centre and German intelligence services, says the campaign primarily targets freelance web designers, engineers and specialists in cryptocurrency and blockchain work. The agencies assess that both the hacking unit and a related network of North Korean IT workers operate under the 313 General Bureau, a unit of the Workers' Party of Korea's Munitions Industry Department.

Fake Interviews, Real Malware

According to the agencies, WaterPlum operatives pose as employers from artificial intelligence, cryptocurrency or NFT companies and recruit victims through social media, job boards and freelance marketplaces. During video interviews or coding tests, targets are told to download a file to "complete an assignment" or fix a supposed technical error; the file instead installs one of five malware families — BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle — that steal browser passwords, cryptocurrency wallet keys, keystrokes and scanned identity documents.

The advisory also describes a parallel scheme in which North Korean nationals pose as legitimate remote IT contractors, sometimes using stolen identity photos supplied by local "enablers" who host so-called laptop farms — banks of company-issued laptops in countries such as Japan or the United States that North Korean workers operate remotely to collect salaries later funneled back to the regime. Japan's National Police Agency said it had dismantled its first such laptop farm domestically, tracing several hundred million yen in cryptocurrency transfers tied to the operation.

Interview Red Flags

The advisory catalogs behavioral tells investigators have observed in suspected North Korean applicants, including refusal to meet in person, requests for payment in cryptocurrency, frequent glances toward an off-camera second screen, and abrupt excuses to turn off video during interviews — in one case attributed to "AI face-swapping software" that operators later admitted to using. It notes the schemes build on years of prior warnings; the Treasury Department's Office of Foreign Assets Control has separately cautioned employers since 2022 that knowingly paying North Korean IT workers can violate U.S. sanctions law.

Investigators recommend that developers avoid executing unfamiliar code outside a sandboxed environment, treat requests to disable antivirus tools or run terminal commands during interviews as a warning sign, and move cryptocurrency to a new wallet with a fresh seed phrase if a device may have been compromised. Companies are urged to deploy endpoint detection tools and verify that remote contractors' claimed locations, language fluency and technical depth are consistent with their resumes.

The advisory, first reported publicly by security outlets including BleepingComputer, comes as Western governments have escalated prosecutions of U.S.-based facilitators who help North Korean workers pose as domestic employees. The FBI said it continues to work with victim companies to identify and prosecute Americans who knowingly provide laptop farms or identity documents to the scheme, describing the effort as part of a broader campaign to cut off a revenue stream that helps fund North Korea's weapons programs.