Breaches and incidentsBriefReported by a reputable outlet, citing the company
WaterPlum / Contagious Interview: 30,000 devices infected via fake job interviews
Joint advisory (Japan NPA, FBI, Australia, Germany’s BfV): from Dec 2025 to Jul 2026 WaterPlum infected at least 30,000 devices in 100+ countries and took...
- Disclosed
What happened
- Joint advisory (Japan NPA, FBI, Australia, Germany’s BfV): from Dec 2025 to Jul 2026 WaterPlum infected at least 30,000 devices in 100+ countries and took funds or credentials from 7,000+ crypto wallets, moving about 1.7B yen (about $10.7M) to North Korea. The advisory also notes Japan’s first dismantled DPRK laptop farm.
- Technique: fake AI, crypto and NFT recruiters; coding tests and “fix your camera” steps that run BeaverTail (npm), InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle (malicious VS Code projects); AI face-swap in interviews.
- Attribution: FBI and Japan NPA assess WaterPlum sits under North Korea’s 313 General Bureau.
Sources
- https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/
- https://therecord.media/north-korean-hackers-infect-thousands-of-devices-waterplum-scheme
- https://www.ic3.gov/CSA/2026/260918.pdf
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.