[CLSTR]
API
< Back to all clusters
[TECHNOLOGY] · Japan, United States, Australia, Germany, North Korea · 18 sources

started · updated

WaterPlum: North Korean hackers steal $10.7M via fake job interviews

WaterPlum Contagious Interview cryptocurrency theft North Korean hackers fake job interviews

International security agencies from Japan, the United States, Australia, and Germany have issued a joint advisory regarding a North Korean-linked cyber campaign known as WaterPlum, or “Contagious Interview.” The operation targets software developers, web designers, and specialists in blockchain, Web3, and artificial intelligence through fraudulent job recruitment processes.

Between December 2025 and July 2026, the group reportedly infected at least 30,000 devices across more than 100 countries. By impersonating recruiters from legitimate technology and crypto firms on social media and job boards, the attackers lure candidates into technical interviews. During these sessions, victims are instructed to download malicious files disguised as coding tests or video-conferencing troubleshooting tools. These files deploy malware families such as BeaverTail, InvisibleFerret, and OtterCookie to steal sensitive data, including browser credentials, screenshots, and cryptocurrency wallet private keys.

The campaign has successfully compromised over 7,000 cryptocurrency wallets, siphoning at least $10.71 million in digital assets to North Korea. Authorities link the WaterPlum group to the 313th General Bureau of the Munitions Industry Department under the Workers' Party of Korea. The operation is part of a broader North Korean strategy to generate foreign currency and place IT workers in foreign organizations to bypass international sanctions.

Entities

313th General Bureau of the Munitions Industry Department · Australian Signals Directorate · FBI · Japan National Police Agency · Munitions Industry Department · North Korea · Waterplum · Workers' Party of Korea

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Tin tặc Triều Tiên WaterPlum đánh cắp 10,7 triệu USD qua tuyển dụng giả – Diễn Đàn Phổ Cập Blockchain [phocapblockchain.net]
Contagious Interview: 30,000 devices infected by a fake job interview [cybernoz.com]
North Korea's Contagious Interview Hack Steals $10. 7M In Crypto [bitnewsbot.com]
North Korean 'Waterplum' Group Steals $10M via Fake Tech Interviews [world-today-journal.com]
Nordkorea-Hacker infizieren Entwickler-PCs mit falschen Jobangeboten [winfuture.de]
北韓駭客組織 WaterPlum 假借「求職面試」狂駭全球 3 萬裝置，盜走千萬美元加密貨幣 | TechNews 科技新報 [infosecu.technews.tw]
North Korean Phishing Crew Hits 30K Devices, Steals $10. 7M Crypto [www.cryptobreaking.com]
Coreia do Norte usa falsas vagas para roubar criptomoedas [www.spacemoney.com.br]
North Korean Fake Job Scams Are Stealing Crypto: How Job Seekers Can Protect Their Wallets and Devices [coinedition.com]
North Korean Hackers Posed as Recruiters. They Infected 30,000 Devices Worldwide - Slashdot [yro.slashdot.org]
北韓駭客的「假面試」騙到 3 萬台電腦，半年偷走 1071 萬鎂加密貨幣 [www.blocktempo.com]
WaterPlum: 30. 000 Rechner über gefälschte Bewerbungen infiziert [www.blogspan.net]
Hackergruppe WaterPlum: 30. 000 Entwickler weltweit infiziert [www.ad-hoc-news.de]
Beware DPRK job scams, ASD warns, but won't confirm local impact [www.itnews.com.au]
How Western tech helps funnel recruits into Russia’s war [www.politico.eu]
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10. 71M in Crypto [thehackernews.com]
FBI Warns US IT Workers as North Korean Hackers 'WaterPlum' Use AI Face Swaps in $10. 7M Fake Job Scam [www.ibtimes.co.uk]
North Korea infects thousands of devices worldwide through fake job offers [www.independent.co.uk]