North Korea’s WaterPlum campaign infected 30,000 devices and stole $10.7 million through fake job interviews
On September 18, 2026, a joint advisory from the FBI, Japan’s police, and several agencies revealed that WaterPlum, a North Korean group, infected more than 30,000 devices across 100-plus countries and siphoned $10.7 million in cryptocurrency through fake job interviews and poisoned repositories. Verify contractor identities and limit their access to source code and credentials.
September 18, 2026. The FBI, Japan’s National Police Agency, and four other agencies publish a joint advisory on WaterPlum, a North Korea-linked group. 30,000 devices. The infection count recorded across more than 100 countries. $10.7 million. The amount of cryptocurrency routed to Pyongyang. Why it matters: the campaign, dubbed Contagious Interview, turns a developer’s job interview into a vector for malware and cryptocurrency theft at industrial scale.
WaterPlum — also tracked as Contagious Interview — ran from December 2025 to July 2026, according to the advisory published by Japan’s NPA, its National Cybersecurity Office, the FBI, the U.S. Defense Department’s Cyber Crime Center, Australia’s ACSC, and Germany’s BND and BfV. The agencies assess that the group operates under the 313th General Bureau, part of the Munitions Industry Department, itself subordinate to the Central Committee of the Workers’ Party of Korea.
The job interview as an infection vector
The mechanics are simple and brutal. WaterPlum actors pose as employers, often impersonating AI, cryptocurrency, or NFT companies, and recruit developers through social media, job boards, and freelance marketplaces. Their targets: web developers, engineers, and crypto and Web3 specialists.
During the technical interview or coding assignment, the victim is told to download and run files hosted on developer platforms and code repositories. Those files load malicious npm packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle. The newest trap, StoatWaffle, arrives inside blockchain-themed Visual Studio Code projects that run code automatically the moment the victim trusts the folder.
What the attacker takes
Once execution is achieved, the actors deploy remote access trojans and infostealers that harvest browser credentials, keystrokes, screenshots, wallet private keys, seed phrases, and ID documents. The infections also open a path into the victims’ employers — a compromised developer becomes a foothold into the company that hired them.
The numbers show the scale. More than 30,000 devices infected across more than 100 countries, with funds or credentials taken from more than 7,000 cryptocurrency wallets. In total, roughly JPY 1.7 billion — about $10.7 million — was transferred to North Korea.
The overlap with the fake IT worker scheme
The advisory establishes a connection defenders had suspected. WaterPlum and North Korea’s fake IT worker apparatus overlap: some WaterPlum actors also work as remote IT workers. The two activities share the same IP addresses to reach laptop farms and crowdsourcing services, and to apply for jobs at a Japanese cryptocurrency exchange.
Laptop farms are sites — often in an enabler’s home — where employment computers are set up and controlled remotely by North Korean workers. Enablers supply the identity documents, bank accounts, and virtual private servers that hide where the workers really are. Japanese authorities have, for the first time, identified and dismantled such a farm on their soil, and their investigations suggest North Korean IT workers moved several hundred million yen abroad, including cryptocurrency.
Some of those workers turned destructive once hired: one extorted a company over payment and published its source code, another defaced a client’s website and took it offline.
What the agencies recommend
The guidance breaks down into three lines. Limit contractors’ access to source code and credentials — a freelancer does not need the whole repository or production secrets. Verify applicants’ identities beyond the video call, since impersonation is the foundation of the campaign. Consider the risks of downstream subcontractors: compromise can arrive through a link you never audited.
For developers, the advice is just as specific. Open unknown projects in Restricted Mode in Visual Studio Code, and inspect the tasks.json file before running anything — that file is what triggers automatic execution in poisoned projects.
# Before opening an unknown project in VSCode, inspect tasks.json
# (poisoned blockchain projects run code on first "Trust")
cat tasks.json 2>/dev/null | grep -iE 'command|exec|curl|wget|bash|powershell|node'
# Find auto-run tasks configured in the .vscode folder
grep -rE 'runOn|command' .vscode/ 2>/dev/null
# Check an npm package's freshness and reputation before installing
npm view <package> time.modified maintainers dist-tagsIdentity verification does not stop at recruitment. Companies that rely on freelancers or remote contractors must treat the hiring channel as an attack surface in its own right, with the same controls as their own systems.
A campaign that has run for years
Contagious Interview is not an isolated episode. The campaign has been documented since 2023, first by Palo Alto Networks and then by Microsoft, and it has kept evolving. What changed is the industrialization: the early fake video interviews have been joined by poisoned coding assignments, compromised repositories, and malicious npm packages, up to the newest StoatWaffle, which runs itself through the tasks.json file of Visual Studio Code.
The joint advisory marks a turning point for another reason: it puts in writing, for the first time, the overlap between WaterPlum and the fake IT worker network. Until now, the two activities were usually described separately — espionage through fake interviews on one side, wage fraud through fake remote employees on the other. The advisory shows they are the same actors, sharing the same IP addresses and the same laptop farm infrastructure.
That convergence has a practical consequence. A company hiring a remote developer can no longer stop at checking technical skills: it must verify the candidate’s physical identity, limit their access to source code and secrets, and watch their behavior once the contract starts. A worker who exfiltrates code, blackmails their employer, or defaces a site is not a theoretical risk — it is the documented extension of this campaign.
Verdict
WaterPlum proves that a fake job interview, paired with poisoned npm packages, is enough to infect 30,000 devices and divert $10.7 million. If you hire freelance developers, verify their identity, limit their access to source code and secrets, and never let a candidate run code on a machine connected to your network. If you develop, open any unknown project in Restricted Mode, inspect tasks.json, and be wary of a coding assignment that asks you to install a package whose origin you have not verified. The interview that promises a job has become, for a patient state-sponsored group, the most profitable theft tool of 2026.