{
  "id": 8815785,
  "title": "North Korean fake recruiters infect 30K devices, steal $10.7M in crypto",
  "url": "https://urgent.news/2026/09/21/north-korean-fake-recruiters-infect-30k-devices-steal-10-7m-in-crypto",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-21T01:42:53.000Z",
  "source": {
    "name": "Cointelegraph",
    "slug": "cointelegraph",
    "url": "https://cointelegraph.com/news/north-korean-fake-recruiters-infect-30k-devices-steal-107m-in-crypto"
  },
  "original_language": "en",
  "account": "North Korean hacking group WaterPlum, also known as Contagious Interview, has targeted developers with fake job offers from crypto, AI, and NFT companies, infecting over 30,000 devices in more than 100 countries. These fake recruiters, impersonating legitimate AI, cryptocurrency, or NFT companies, have stolen at least $10.7 million by luring unsuspecting job seekers with malware. The group primarily targets web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies. WaterPlum's tactics include recruiting on social media, online platforms, gig work platforms, or freelance marketplaces. Once inside a victim's computer, they use remote-access trojans and infostealing malware to exfiltrate sensitive data and cryptocurrency. The damage extends beyond stolen cryptocurrency, as stolen identity documents can enable North Korean IT workers to impersonate victims and earn income, or sensitive information can be used for extortion.",
  "summary": "North Korean cyber group WaterPlum targeted developers with fake jobs at crypto, AI and NFT companies, infecting at least 30,000 devices across more than 100 countries.",
  "key_points": [
    "North Korean hacking group WaterPlum targets developers with fake job offers.",
    "Fake recruiters infect over 30,000 devices in 100+ countries, stealing $10.7M in crypto.",
    "Tactics include social media recruitment, malware installation, and data exfiltration."
  ],
  "editors_take": "This campaign by North Korean hackers significantly expands their global reach and deepens their ability to exploit the job market and drain cryptocurrency assets from vulnerable individuals.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}