WaterPlum's Fake Job Interviews Hit 30,000 Devices in 100 Countries

Thirty thousand devices. More than 100 countries. Over 7,000 cryptocurrency wallets with funds or credentials taken. That is the scorecard for WaterPlum, the North Korean group behind the long running Contagious Interview campaign, as tallied in a joint advisory published September 18, 2026 by the Japanese National Police Agency, the FBI and IC3, and Australian and German authorities including the Verfassungsschutz. In Japan alone, investigators tracked 1.7 billion yen, roughly 10.71 million US dollars, leaving victim wallets between December 2025 and July 2026.

None of that started with a zero day. It started with a recruiter. Someone reached out about a role at an AI startup, a crypto exchange, an NFT platform. The company looked real because the attackers built it to look real. The candidate did what candidates do: they were flattered, they were eager, and when the interviewer said the video call was glitching and shared a fix, they ran it.

The interview is the intrusion

The advisory describes an operation built entirely around the hiring funnel. WaterPlum operators impersonate legitimate AI, cryptocurrency and NFT companies and work through recruiting and freelance platforms. The technical assessment stage is where the compromise happens. Candidates are told to clone a project and get it running, or to troubleshoot a broken video conferencing session, or simply to execute a snippet the interviewer pastes into chat. Each of those is a completely normal request during a developer interview. That is the point.

Once code runs, the collection is broad: browser credentials, clipboard contents, keystrokes, cryptocurrency private keys and seed phrases, documents and screenshots. A developer laptop is a rich target precisely because it holds both personal wallets and corporate access, and job hunting is one of the few activities people deliberately keep off their employer's radar. Nobody reports a suspicious recruiter to the SOC while they are still hoping the offer comes through.

Five malware families, one delivery story

The advisory links five families to WaterPlum, and the spread across languages and ecosystems shows how much engineering is behind this:

• BeaverTail, JavaScript malware delivered inside npm packages
• InvisibleFerret, a Python based backdoor used for follow on access
• OtterCookie, a JavaScript remote access trojan and information stealer
• OtterCandy, which merges OtterCookie's stealing with full RAT capability
• StoatWaffle, modular Node.js malware delivered through malicious Visual Studio Code projects

This is a state revenue line, not a hobby

The advisory attributes WaterPlum to the 313 General Bureau, part of North Korea's Munitions Industry Department. That placement matters. This is not an intelligence collection unit that happens to steal crypto on the side. It sits inside the apparatus that funds weapons production, which means the operation is measured in money moved and will be resourced accordingly. Eight months of activity, 30,000 devices and five maintained malware families is what a funded product team looks like, not what an opportunistic crew looks like.

The RedEye take

The security industry spent years telling users not to click links in email, and largely won that fight. We never had the equivalent conversation about code, because telling a developer not to run unfamiliar code sounds like telling them not to do their job. WaterPlum found that gap and industrialized it. Thirty thousand devices is not a phishing success rate, it is an indictment of how much implicit trust rides on a package.json, a repository clone and a screen share.

There is also an uncomfortable organizational truth in these numbers. Most of these compromises happened on machines during personal time, on personal ambition, using the same laptop that holds the corporate VPN certificate. Security programs have no visibility into the job search, and the deliberate secrecy around interviewing means the victim is motivated to stay quiet even after something feels wrong. Any control that depends on the employee volunteering that they were talking to a recruiter is a control that does not exist. Build for the case where they never tell you, and make the safe path, a disposable sandbox for any code that arrives from outside, faster to use than the unsafe one.

What defenders should learn

• Treat package install scripts as arbitrary execution, because they are. Setting ignore-scripts across developer machines removes BeaverTail's easiest path from clone to code execution and costs almost nothing in daily friction.
• Audit your editors, not just your endpoints. StoatWaffle ships inside Visual Studio Code projects, and a workspace task configured to run when the folder opens executes before a human reads a single line. Hunt for that configuration across your fleet today.
• Give engineers a sanctioned throwaway environment for outside code, and make it a one command action. The advisory's own guidance is to avoid running unknown code outside a sandbox, which only works if the sandbox is already there when curiosity strikes.
• Verification is bidirectional. The advisory tells employers to verify applicant identity, location and qualifications, but this campaign inverts that: your staff need a way to verify the company that is recruiting them. Say out loud that checking a recruiter is normal and not disloyal.
• Assume personal crypto compromise becomes corporate compromise. Over 7,000 wallets were hit by malware that also takes browser credentials and keystrokes. When an employee reports a drained personal wallet, that is an incident ticket, not a sympathy card.

Source

Reporting and figures from BleepingComputer, "North Korean WaterPlum hackers infected 30,000 devices worldwide," covering the joint advisory issued September 18, 2026 by Japanese, US, Australian and German authorities.

npm config get ignore-scripts

grep -rl --include=package.json -E '"(preinstall|postinstall|prepare)"' ~/Documents ~/Downloads ~/Projects 2>/dev/null | head -50

grep -rl --include=tasks.json '"runOn".*"folderOpen"' ~ 2>/dev/null

npm config set ignore-scripts true

mkdir -p ~/.no-git-hooks && git config --global core.hooksPath ~/.no-git-hooks

mkdir -p ~/Quarantine && mv ~/Downloads/interview-project ~/Quarantine/