Seven government agencies in four countries have attributed the WaterPlum fake job interview campaign to North Korea. The advisory, published on 18 September 2026, says the scheme infected more than 30,000 devices across over 100 countries between December 2025 and July 2026. Roughly 7,000 cryptocurrency accounts were drained.
What the Joint Advisory Says
The advisory is a coordinated public attribution rather than a new vulnerability disclosure: the agencies are naming the group, the unit behind it and the methods it uses. It was issued jointly by Japan’s National Police Agency and National Cybersecurity Office, the United States Federal Bureau of Investigation and the Department of Defense Cyber Crime Center, the Australian Signals Directorate’s Australian Cyber Security Centre, and Germany’s foreign and domestic intelligence services, the BND and the BfV.
The agencies place WaterPlum, which security researchers have tracked for two years under the name Contagious Interview, under the 313 General Bureau of the Munitions Industry Department, a body reporting to the Central Committee of the Workers’ Party of Korea.
| Item | Figure as stated by the agencies |
|---|---|
| Devices infected | More than 30,000 |
| Countries and regions affected | More than 100 |
| Cryptocurrency accounts compromised | About 7,000 |
| Value moved to North Korea | About 1.7 billion yen, roughly $10.7 million |
| Period covered | December 2025 to July 2026 |
| Advisory date | 18 September 2026 |
Dollar conversions of the yen figure differ slightly between outlets: Cryptopolitan and The Cyber Express both give about $10.71 million, The Record put the total at more than $10.5 million, and CyberScoop rounded it to nearly $11 million. The underlying yen figure is the same in each report.
How the Fake Interview Works
The attack is a hiring conversation that turns into a software install. WaterPlum operators pose as recruiters for artificial intelligence, cryptocurrency and non-fungible token companies, and the malware only arrives once the target believes a real job is on the table.
- First contact: An operator posing as a recruiter approaches software developers, web designers and blockchain specialists through social media, job boards and freelance marketplaces.
- Building credibility: The conversation advances through ordinary-looking screening stages toward a technical interview.
- The request: The candidate is asked either to run a coding assignment or to fix a problem with the video-conferencing software during the call itself.
- Delivery: Both pretexts install malware, typically through malicious Node Package Manager packages hosted on GitHub or Bitbucket.
- Collection: The implant harvests credentials and wallet material and, in several of the families, keeps remote access open afterwards.
The decisive detail for readers is that no attachment needs to be opened and no obvious warning appears. An unsolicited coding test, Git repository or npm package sent by a recruiter is untrusted software, and it behaves like untrusted software the moment it runs.
The Five Malware Families Named
The advisory lists five families, and they divide the work between stealing and staying. The advisory’s own descriptions are the source for what each one is.
| Family | What the advisory describes |
|---|---|
| BeaverTail | JavaScript malware hidden inside Node Package Manager packages, downloadable from GitHub or Bitbucket |
| InvisibleFerret | Python-based malware used alongside BeaverTail |
| OtterCookie | A JavaScript remote access trojan that also steals information |
| OtterCandy | Combines the features of OtterCookie with the RATatouille toolset |
| StoatWaffle | A modular Node.js family combining a loader, credential harvesting and a remote access trojan for persistence |
StoatWaffle is the one worth understanding in detail, because it does not need the victim to run anything deliberately. The advisory describes blockchain-themed project repositories that carry a malicious Microsoft Visual Studio Code configuration file; opening the folder and marking it as trusted is enough to trigger automatic code execution. The Cyber Express, summarising the advisory, reports that the implants target credentials, clipboard contents, keystrokes, screenshots, wallet keys, seed phrases, identity documents and source code.
What to Do if You Ran an Interview Task
Treat the machine as compromised and work outwards from the money, because wallet keys and seed phrases are the fastest-moving loss. The steps below follow the mitigation guidance carried in the advisory and summarised by The Cyber Express.
- Move funds first: From a different, clean device, transfer cryptocurrency to a wallet whose keys have never been present on the affected machine.
- Rotate credentials from a clean device: Change passwords and revoke session tokens from hardware that was never involved, not from the machine you are worried about.
- Assume every secret on the machine is gone: That includes API keys, SSH keys, browser-stored passwords and anything held in a password manager that was unlocked.
- Inspect before you open anything else: Open unfamiliar projects in Visual Studio Code’s Restricted Mode and read the .vscode/tasks.json file before trusting the folder.
- Reinstall the operating system: Several of these families are built for persistence, so removing a single file is not a fix.
Going forward, the advisory’s guidance is to run any code sent by a prospective employer only inside a virtual machine, and to treat commands containing curl, base64, -enc, mshta or Invoke-WebRequest as red flags rather than setup instructions. If you hold cryptocurrency on the same machine you use for interview tasks, the separation between the two is worth more than any single security tool; general guidance on cold storage and key management applies directly here.
The Half of the Advisory Aimed at Employers
The same document covers a second North Korean operation running in the opposite direction. Where WaterPlum pretends to hire, North Korean information technology workers use stolen or borrowed identities to be hired, taking salaried and contract roles at technology companies and routing the earnings home.
For companies, the advisory’s guidance is procedural rather than technical: check whether an applicant’s connecting IP address matches the location they claim, and treat a persistent refusal to meet in person, repeated audio and video freezes during calls, or signs of face-swapping software as reasons to verify identity before an offer is made.
Japan reported its first dismantling of a domestic laptop farm connected to this activity, an arrangement in which company-issued machines are kept in one country while being operated from another. Several hundred million yen in cryptocurrency was transferred from that operation to addresses outside Japan, according to Japanese authorities cited in the advisory. In the United States, the FBI continues to prosecute domestic facilitators who host such equipment.
Where This Stands as of 19 September 2026
As of 19 September 2026, the advisory is one day old and no arrests outside Japan have been announced in connection with it. The agencies have published the group’s tactics, techniques and indicators for defenders, but they have not said the campaign has stopped; the figures describe activity up to July 2026, not a concluded operation.
What has not been disclosed: how many of the 30,000 devices belonged to individuals rather than companies, which countries carried the heaviest concentration of victims, and whether any of the roughly 1.7 billion yen is recoverable. None of the four governments has attached a sanctions action or an indictment to this particular publication.
Frequently Asked Questions
What Is WaterPlum?
WaterPlum is a North Korean state-linked cyber group that security researchers have also tracked as Contagious Interview. In the 18 September 2026 advisory, four governments placed it under the 313 General Bureau of the Munitions Industry Department.
How Does the WaterPlum Fake Job Interview Infect a Device?
Operators posing as recruiters ask candidates to run a coding assignment or to troubleshoot a video-call problem during a technical interview. Either task installs malware, usually delivered through malicious npm packages hosted on GitHub or Bitbucket.
Who Is Being Targeted?
Software developers, web designers and cryptocurrency and blockchain specialists worldwide. The approaches come through social media, job boards and freelance marketplaces rather than through any single platform.
How Much Did WaterPlum Steal?
The agencies put the total moved to North Korea at about 1.7 billion yen, roughly $10.7 million, taken from around 7,000 cryptocurrency accounts between December 2025 and July 2026.
Is It Safe to Take a Coding Test From a Recruiter Now?
Coding tests from verified employers remain normal practice. The advisory’s guidance is to run any code sent by someone you have not verified inside a virtual machine, and never on a device that holds cryptocurrency keys or work credentials.
