A North Korean-linked cyber group is using fake job opportunities to target software developers and IT professionals, infecting at least 30,000 devices across more than 100 countries and stealing cryptocurrency and sensitive information, according to a joint advisory issued by cybersecurity authorities from Australia, the United States, Japan and Germany.
The group, known as WaterPlum and also referred to as “Contagious Interview,” compromised more than 30,000 devices between December 2025 and July 2026, according to the advisory. Authorities said the group obtained funds or credentials from more than 7,000 cryptocurrency wallets and transferred at least 1.7 billion Japanese yen, equivalent to approximately US$10.71 million, in cryptocurrency to North Korea.
The campaign primarily targets individual IT professionals, including software developers, web designers, freelancers and people working in cryptocurrency, blockchain and Web3.
Fake job interviews become the entry point
WaterPlum operators reportedly pose as recruiters or potential employers and advertise attractive technology positions through social media, online job platforms and freelance marketplaces.
After making contact, the attackers may ask applicants to participate in an online technical interview or complete a coding assignment.
The malicious element is introduced when applicants are instructed to download software or files to resolve an alleged technical problem, participate in a video interview or complete the assignment.
According to the joint advisory, attackers have distributed malicious packages through developer platforms and code repositories. These packages have contained malware including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle.
Once installed, the malware can provide attackers with access to the victim's device.
The attackers can then deploy remote-access tools and information-stealing malware to collect browser credentials, passwords, cryptocurrency wallet information, keystrokes, screenshots and files stored on the computer or shared folders.
For cryptocurrency users, the consequences can be particularly serious because stolen wallet credentials, private keys or seed phrases can potentially give attackers direct access to digital assets.
The attackers are also targeting the companies behind the workers
The threat does not necessarily stop with the individual applicant.
Authorities said some WaterPlum actors also operate as North Korean IT workers, taking legitimate-looking contracts involving web development and other technical work.
If a malicious actor successfully obtains employment or a contract with a company, the access provided for legitimate work could potentially become an entry point into corporate systems.
The advisory warns that compromised accounts can enable further activity inside an organisation, including theft of intellectual property, additional lateral movement and access to sensitive corporate information.
This creates a difficult security challenge for employers: the initial threat may appear to be a normal recruitment process rather than a conventional phishing campaign.
AI and video impersonation add another layer
The campaign also demonstrates how attackers are using technology to make fake identities more convincing.
Authorities observed WaterPlum members using AI-based face-swapping technology during online interviews. In some cases, the operators reportedly disabled their cameras after a short period, citing network problems.
The advisory also documents suspicious recruitment patterns involving exaggerated technical résumés, inconsistencies in applicants' claimed backgrounds and reluctance to participate in face-to-face meetings.
These tactics make traditional visual verification during video interviews less reliable.
For employers hiring remotely, identity verification therefore needs to extend beyond simply seeing a candidate on a video call.
"Laptop farms" help hide the operators' locations
Japanese authorities also identified and dismantled a so-called “laptop farm” used to support North Korean IT workers.
A laptop farm is a physical location where computers belonging to employers or clients can be installed and remotely operated by workers elsewhere.
According to the advisory, these arrangements can allow North Korean IT workers located in countries including North Korea, China and Russia to remotely access employment-related computers while intermediaries handle the physical devices. Some operators were also identified in Africa and Southeast Asia.
Authorities said intermediaries can also help establish virtual private servers and manage accounts, making it more difficult to determine where the individuals performing the work are physically located.
What companies can do
The joint advisory recommends several measures for organisations that employ developers, contractors or remote workers.
Companies should carefully verify applicants' identities and employment histories, pay attention to inconsistencies in technical experience, and consider whether the applicant's network location matches their claimed location.
Once someone is hired, access should be limited to only the systems, credentials, source code and data required for their work.
Companies should also be prepared to quickly revoke accounts and active sessions if a contractor or employee is suspected of being malicious. Endpoint Detection and Response (EDR) tools can help organisations detect suspicious activity on corporate devices.
For developers, the authorities advise against executing untrusted code on machines containing cryptocurrency wallets or sensitive information. Unknown software projects should be treated cautiously, particularly when applicants are instructed to download code or developer packages during a recruitment process.
A growing intersection of recruitment fraud and cybersecurity
The WaterPlum campaign demonstrates how cybersecurity threats can begin long before an employee receives access to a corporate network.
A fake job advertisement can become the initial social-engineering mechanism. A coding assignment can become the malware delivery method. A compromised developer workstation can then become the bridge into corporate systems.
The campaign also shows how AI-generated impersonation and remote-work infrastructure can make traditional identity checks more difficult.
For technology companies, recruitment teams and IT professionals, the lesson is straightforward: a job interview is now another potential attack surface.
As attackers continue to combine social engineering, malware, cryptocurrency theft and remote-work infrastructure, organisations may need to treat recruitment security and employee identity verification as part of their broader cybersecurity strategy.
JinseFinance
Weatherly
Davin
Beincrypto
Coindesk
Bankless
Cointelegraph
Bitcoinist