A joint law enforcement advisory from authorities in the United States, Japan, Australia, and Germany has detailed the operations of WaterPlum, a North Korean hacking group that compromised at least 30,000 devices in more than 100 countries between December 2025 and July 2026, funneling over $10.7 million in stolen cryptocurrency back to the regime.

WaterPlum is tied to the long-running “Contagious Interview” campaign, which targets job seekers by impersonating legitimate AI, cryptocurrency, and NFT companies or by using recruiting and freelance platforms to make contact. During fake interviews and coding assessments, victims are asked to download project files, troubleshoot bogus video-conferencing issues, or run supplied code, actions that trigger the malware infection.

Malware arsenal

The advisory attributes several malware families to WaterPlum, including:

  • BeaverTail: JavaScript malware hidden in npm packages
  • InvisibleFerret: A Python-based backdoor
  • OtterCookie: A JavaScript remote-access trojan and info stealer
  • OtterCandy: Malware combining OtterCookie and RAT capabilities
  • StoatWaffle: Modular Node.js malware delivered via malicious Visual Studio Code projects that auto-execute code when a folder is opened and trusted

Once installed, the malware harvests browser credentials, clipboard data, keystrokes, cryptocurrency private keys and seed phrases, documents, and screenshots. According to the advisory, over 7,000 cryptocurrency wallets had funds or credentials exfiltrated. Attackers have also used compromised machines to pivot into victims’ employer or client networks, enabling intellectual property theft and espionage.

Links to fraudulent IT worker schemes

Investigators found overlap between WaterPlum operators and North Korea’s fraudulent remote IT worker operations, including shared IP addresses. Some WaterPlum actors reportedly moonlight as remote web developers, and stolen identity documents from WaterPlum victims are reused by North Korean IT workers to secure jobs under false identities. The FBI and Japanese police assess that both groups operate under North Korea’s 313 General Bureau, part of the Munitions Industry Department responsible for weapons research and production.

Investigators also observed WaterPlum actors using AI face-swapping software during video interviews, then disabling cameras and blaming network issues to avoid detection. Japan’s National Police Agency separately announced the dismantling of the country’s first identified North Korean IT-worker “laptop farm,” uncovering evidence that several hundred million yen had been transferred overseas.

Recommendations

The advisory urges companies to rigorously verify job applicants’ identities, locations, and qualifications, and to limit new hires’ access to only the systems needed for their role. Developers are advised to avoid executing unfamiliar code outside a sandbox and to inspect provided files for commands that fetch additional payloads.