WaterPlum compromises 30,000 devices through fake interviews

North Korean cyber operatives have targeted approximately 30,000 devices across more than 100 countries using fraudulent job interviews, according to authorities from four countries. The attack, attributed to a group known as WaterPlum or Contagious Interview, specifically aimed at web designers, software engineers, freelancers, and specialists in cryptocurrency, blockchain, and Web3 technologies between late 2025 and early 2026.

By impersonating legitimate companies through social media, online job platforms, and gig marketplaces, the attackers lured victims into technical interviews, asking them to download and execute malicious files. These files often contained malware, enabling the attackers to gain backdoor access and deploy remote-access trojans and information stealers.

This allowed them to steal more than 7,000 cryptocurrency wallets and transfer at least 1.7 billion yen, equivalent to about $10.71 million, to North Korea. Japanese and US authorities claim that WaterPlum operators and some North Korean IT workers are part of the 313 General Bureau of the Munitions Industry Department, a subordinate unit to the Central Committee of the Workers' Party of Korea.

The group uses a variety of deceptive tactics, including AI face-swapping and disabling videos during interviews. Authorities warn that the malware can harvest sensitive information, including private keys, cryptocurrency wallet data, and personal documents, posing risks not only to individuals but also to their employers, clients, and organizations.