A North Korea-linked group known as WaterPlum, or Contagious Interview, has infected at least 30,000 devices in more than 100 countries through fake job interviews, according to a joint advisory published on 18 September by Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center and intelligence agencies from Australia and Germany. The campaign mainly targets freelance developers and blockchain and Web3 specialists.
Attackers pose as recruiters or hiring managers, often impersonating AI, cryptocurrency or NFT companies, then ask candidates to download a file for a coding test or to fix a supposed bug during a video interview.
The downloads can contain BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle malware. These tools can steal browser credentials, cryptocurrency-wallet data, clipboard contents, keystrokes, screenshots and files, as well as provide backdoor or remote-access capabilities. The advisory says funds or credentials were taken from more than 7,000 cryptocurrency wallets, with 1.7 billion Japanese yen—approximately $10.71 million in cryptocurrency assets—transferred to North Korea. A successful infection may also enable espionage, source-code theft and further movement through an employer’s network.
The authorities also linked the campaign to North Korean IT-worker schemes involving “laptop farms”, where facilitators host company-issued computers and allow remote access. Shared IP addresses have reportedly connected the cyberattack operators with this network. The advisory highlights warning signs including scripted answers, unexplained background voices, repeated video freezing and requests for payment in cryptocurrency, sometimes to another person’s account.
It also describes a Japanese crypto exchange rejecting a suspicious applicant in May 2025 after inconsistencies in his claimed background and language skills.