NORTH Korea-linked WaterPlum, also known as Contagious Interview, infected at least 30,000 devices across more than 100 countries between around December 2025 and July 2026, according to a joint advisory from authorities including Japan’s National Police Agency, the FBI, Australia’s ACSC and Germany’s BND and BfV. The operation allegedly stole funds or credentials from more than 7,000 cryptocurrency wallets, with at least JPY1.7bn ($10.7m) in cryptocurrency transferred to North Korea. The NPA and FBI assessed that WaterPlum and some North Korean IT workers operate under the 313 General Bureau.
The attackers posed as employers, often claiming to represent AI, cryptocurrency or NFT companies, and targeted developers through social media, job boards and freelance platforms. Victims were asked to run files during technical interviews or coding tests, including malicious NPM packages containing BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle. The latter was delivered through blockchain-themed Visual Studio Code projects that could execute code after a victim trusted the folder.
The resulting malware stole browser credentials, keystrokes, screenshots, wallet keys, seed phrases and identity documents, and could provide access to victims’ employers. The agencies advised opening unfamiliar projects in Restricted Mode and checking `tasks.json` before running them.
The advisory also linked the activity to North Korea’s IT-worker scheme, citing shared IP addresses and applications to a Japanese cryptocurrency exchange. Japanese authorities said they had dismantled a laptop farm in Japan, where employment computers were remotely controlled. Organisations were urged to verify applicants, restrict contractors’ access to code and credentials, and assess risks from subcontractors.