WaterPlum Contagious Interview Campaign Targets IT Professionals Through Fake Jobs

Police and intelligence agencies in Japan, the United States, Australia and Germany have jointly
named a North Korean group called WaterPlum, known in the security industry as Contagious
Interview, which poses as a recruiter to trick software developers and freelancers into running malicious
files during fake job interviews. Between December 2025 and July 2026 the group infected at least
30,000 computers in over 100 countries, took funds or account credentials from more than 7,000
cryptocurrency wallets, and sent 1.7 billion Japanese yen (10.71 million US dollars) in cryptocurrency
to North Korea. Any company that hires developers, contractors or freelancers is exposed, because a
single compromised laptop gives the actors a route into the employer’s network and a stolen identity
they can reuse to win more contracts.

1. Campaign Overview

Six agencies published a joint attribution on 18 September 2026: the National Police Agency and National Cybersecurity
Office of Japan, the FBI and the Department of Defense Cyber Crime Center, the Australian Signals Directorate’s
Australian Cyber Security Centre, and Germany’s BND and BfV. From around December 2025 through July 2026
WaterPlum exploited at least 30,000 PCs in over 100 countries, moved funds or account credentials from more than
7,000 cryptocurrency wallets, and exfiltrated at least 1.7 billion Japanese yen (10.71 million USD) in cryptocurrency.
Japanese authorities identified, investigated and dismantled the first laptop farm found in Japan, run by a domestic
enabler.

2. Targeting and Attribution

WaterPlum actors pose as prospective employers and approach software developers, web freelancers, engineers
and specialists in cryptocurrency, blockchain and Web3 through social media, online job platforms, gig work
platforms and freelance marketplaces. They impersonate legitimate artificial intelligence, cryptocurrency and non
fungible token companies, and have also used recruiting services. The NPA and the FBI assess both WaterPlum
cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry
Department, subordinate to the Central Committee of the Workers Party of Korea. WaterPlum actors and North
Korean IT workers used the same IP addresses when accessing laptop farms.

3. Attack Chain

The chain runs through a recruitment cycle rather than an exploit, so the victim installs the malware themselves.

• Initial Access FAKE RECRUITMENT: Actors contact job seekers with an attractive job offer and require a technical online interview or a coding assignment. They run interviews with artificial intelligence face-swapping software, then disable their video after a few minutes and ask the target to do the same, blaming network problems.
• Execution MALICIOUS ASSIGNMENT: During the interview the actors tell the job seeker to download and run files hosted on collaboration platforms and code repositories, framed as a coding task or a fix for an error in the video conferencing tool. The files are malicious npm packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.
• Persistence REMOTE ACCESS TROJANS: Once the loader gives backdoor access to the victim’s network, the actors deploy remote access trojans to keep connectivity, hold persistence and open routes to pivot across victim systems.
• Collection INFOSTEALERS: Infostealers take authentication data stored in web browsers, clipboard contents, recorded keystrokes and screenshots, cryptocurrency wallet private keys and seed phrases, and any files of interest including pictures of driving licences and passports.
• Exfiltration DIRECT TO C2: Stolen data and cryptocurrency go to a command and control IP address that the actors use to manage infected devices and networks remotely. Funds are moved on to the DPRK.

4. Malware and Capabilities

The delivered malware families share one goal: take the wallet, the credentials and the identity.

• BeaverTail and InvisibleFerret: BeaverTail is JavaScript malware hidden inside npm packages and downloadable from GitHub or Bitbucket. It pulls in InvisibleFerret, a Python backdoor that steals information and takes commands from the C2 server.
• OtterCookie and OtterCandy: OtterCookie is a JavaScript remote access trojan and information stealer built to take cryptocurrency-related data. OtterCandy combines the features of OtterCookie and RATatouille.
• StoatWaffle and VS Code abuse: StoatWaffle is a modular Node.js family combining a loader, credential harvesting and a RAT. It uses blockchain-themed project repositories as decoys and embeds a malicious Visual Studio Code configuration file that auto-runs code when the folder is opened and trusted.
• Identity theft and follow-on damage: Stolen ID images let North Korean IT workers impersonate victims and win contracts. Access to a developer’s machine opens the employer’s network to espionage, intellectual property theft and lateral movement, and the stolen data has been used for extortion.

5. Adversary Toolkit

6. Recommendations

• Treat any device that ran an unsolicited recruiter’s coding assignment as compromised: disconnect it from the internet, back up essential data, and perform a full reset of the operating system.
• Assume wallet data is already stolen. Create a new cryptocurrency wallet on a separate clean device, move all assets to it, and store the new seed phrase offline.
• Open unknown projects in Visual Studio Code using Restricted Mode, answer No to the trust prompt, and read any .vscode/tasks.json file before trusting a folder, since that file can run code on launch.
• Hunt endpoint and proxy logs for npm installs from sources outside the official registry, and for scripts containing curl, base64, -enc, mshta, Invoke-WebRequest, iwr or hidden running shortly after a package install.
• Rotate browser-stored passwords, session tokens and API keys for every affected developer, and revoke accounts and sessions for any contractor you suspect is a North Korean IT worker.
• Tighten contractor vetting: check that applicant IP addresses match the claimed country of residence, call the contact number given, ask for detailed explanations of listed skills, and limit new remote hires to the minimum source code and credential access they need.

7. Sources

• https://www.npa.go.jp/news/release/2026/20260918001.html
• https://www.ic3.gov/CSA/2026/260918.pdf
• https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/north-korean-waterplum-commonly-referred-to-as-contagious-interview-cyber-actor-group-targeting-it-professional
• https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/praevention_wirtschafts-und_wi
  ssenschaftsschutz/2026-09-18-joint-cybersecurity-advisory.html

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.