A multinational group of law-enforcement, intelligence and cybersecurity agencies issued a coordinated warning on September 18 about WaterPlum, a North Korea-linked cyber group accused of compromising tens of thousands of technology workers’ computers through fraudulent recruitment and technical-interview schemes.

The advisory was issued by Japan’s National Police Agency and National Cybersecurity Office, the U.S. Federal Bureau of Investigation and Department of Defense Cyber Crime Center, the Australian Signals Directorate’s Australian Cyber Security Centre, Germany’s Federal Intelligence Service and Germany’s Federal Office for the Protection of the Constitution. Japanese authorities described the release as a joint public attribution intended both to expose the group’s methods and to strengthen defenses against North Korean cyber and revenue-generation activity.

Authorities said WaterPlum, commonly referred to by cybersecurity researchers as Contagious Interview, infected at least 30,000 PCs in more than 100 countries from approximately December 2025 through July 2026. Japan and the United States were among the affected countries, while the broader campaign reached users across multiple regions.

The principal targets included web designers, software engineers and specialists working in cryptocurrency, blockchain and Web3. The actors obtained funds or account credentials associated with more than 7,000 cryptocurrency wallets and exfiltrated at least 1.7 billion Japanese yen, or approximately $10.71 million, in cryptocurrency from victims on behalf of North Korea, according to the advisory.

The campaign is notable for turning the technology sector’s recruiting process into the initial-access mechanism. WaterPlum actors pose as employers or recruiters and approach software developers through social networks, employment platforms, gig-work services and freelance marketplaces. Authorities said the operators frequently impersonate legitimate companies in artificial intelligence, cryptocurrency and non-fungible-token businesses, sectors in which developers are accustomed to remote recruiting and coding assessments.

After establishing contact, the purported recruiter may request an online technical interview or a programming assignment. Victims are instructed to download code, open a software project or execute files supposedly needed to complete the task or fix an issue with an online interview environment. The workflow is deliberately designed to resemble normal developer activity, reducing the likelihood that a candidate will treat the files with the same suspicion applied to an unsolicited executable attachment.

According to the joint advisory, malicious files have been hosted through developer collaboration services and code repositories. WaterPlum has distributed malicious Node Package Manager packages containing malware families or variants identified as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle.

BeaverTail is described in the advisory as JavaScript-based malware hidden inside NPM packages. InvisibleFerret is a Python-based backdoor, while OtterCookie is a JavaScript remote-access and information-stealing tool. Authorities said OtterCandy combines features associated with OtterCookie and another remote-access tool. StoatWaffle, meanwhile, is described as a modular Node.js malware family incorporating loader, credential-harvesting and remote-access capabilities.

StoatWaffle illustrates how developer tooling can itself become part of the attack surface. The advisory said the malware can use blockchain-themed Visual Studio Code projects as decoys, with malicious configuration content capable of triggering code execution after a victim opens and trusts a project. That mechanism is particularly relevant to software engineers because downloading repositories and opening unfamiliar projects is a routine component of collaboration, interviewing and open-source development.

Once WaterPlum establishes backdoor access, authorities said the group can deploy remote-access trojans to maintain connectivity and persistence and potentially pivot across the victim’s systems. Information stealers can then send sensitive material and cryptocurrency-related data to command-and-control infrastructure.

The targeted information is broader than cryptocurrency alone. Authorities said WaterPlum has sought authentication information stored in browsers, including user IDs and passwords, as well as clipboard contents, keystrokes and screenshots. Cryptocurrency-wallet private keys and seed phrases are among the highest-value targets, while files containing passports, driver’s licenses and other identity documents may also be taken.

That creates a secondary enterprise risk. A developer may initially be attacked as an individual job seeker, but the compromised computer can contain credentials or connections associated with an employer, customer or contracting company. The advisory warned that successful infections may create opportunities for espionage, theft of intellectual property and lateral movement into corporate environments. Credentials stolen from one engineer can therefore become an entry point into a larger technology organization.

Authorities also warned that stolen identity documents can be reused in another component of North Korea’s technology-related revenue operations. Images of legitimate IDs may enable North Korean IT workers to impersonate other people while seeking contracts or employment, potentially creating a cycle in which information collected through one cyber campaign supports subsequent fraudulent employment activity.

The FBI and Japan’s National Police Agency assess that WaterPlum actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, which is subordinate to the Central Committee of the Workers’ Party of Korea. The attribution links the hacking activity with a broader system in which North Korean technology personnel seek overseas work while concealing their true identities and locations.

The September 18 advisory devotes substantial attention to so-called laptop farms. These are locations where employment-related computers are physically maintained by an intermediary but remotely controlled by workers elsewhere. Authorities said such arrangements allow North Korean personnel to appear to be working from the country where the device is located, while virtual private servers and other infrastructure can further obscure their actual location.

North Korean workers using these arrangements may obtain software-development and web-system contracts from businesses or through crowdsourcing platforms. The advisory said the workers involved are generally located in North Korea, China or Russia, with smaller numbers operating from Africa and Southeast Asia.

Japanese authorities said they had, for the first time in Japan, identified, investigated and dismantled a laptop farm operated by an enabler. Investigators obtained evidence that several hundred million yen, including cryptocurrency assets, had been transferred to foreign locations through related activity. The FBI separately said it continues to identify and prosecute U.S.-based individuals accused of facilitating North Korean IT-worker operations.

The combined warning underscores why the issue is increasingly relevant to corporate technology management rather than only to security teams at cryptocurrency companies. Remote hiring, contractor marketplaces, distributed software teams and cloud-based development tools have expanded the number of legitimate circumstances in which companies interact with programmers whom they have never met in person. Those same practices create opportunities for attackers to exploit trust established during recruitment.

The advisory also cited an attempted recruitment case at a Japanese cryptocurrency exchange. In May 2025, the company received an engineering application that authorities assessed was submitted by a suspected North Korean IT worker using a forged résumé and a VPN. The company detected inconsistencies during the recruitment process and did not hire the applicant, preventing damage.

Authorities said indicators observed in suspected fraudulent applications can include unusually broad claims of expertise spanning numerous programming languages, blockchain technologies and cloud services, inconsistencies between claimed professional experience and performance during technical questioning, reluctance to attend in-person meetings and requests to receive compensation in cryptocurrency or through accounts held in other names.

However, the agencies’ guidance places particular emphasis on verification rather than relying on any single behavioral characteristic. Employers are encouraged to scrutinize contact information, confirm professional certifications where possible, examine whether network locations align with an applicant’s stated residence and ask detailed questions about skills claimed on a résumé. The advisory warns that more than one person may sometimes support a candidate behind the scenes during remote interviews.

The WaterPlum side of the operation presents a different defensive challenge because legitimate applicants are themselves the targets. Authorities recommend that developers avoid executing unfamiliar third-party code directly on systems containing sensitive information or cryptocurrency assets. Unknown code should instead be reviewed and isolated in appropriate sandboxed or virtualized environments.

Companies were also advised to deploy endpoint detection and response technology capable of identifying suspicious behavior after malicious software reaches a workstation. Development organizations may need to treat recruiting assignments and external repositories as part of their software supply-chain security model, particularly when engineers use the same machines for interviews, company development work, cloud administration and cryptocurrency activity.

Visual Studio Code users received specific guidance. The advisory recommends avoiding unknown projects or opening them only in Restricted Mode, which limits potentially dangerous automated behavior. Developers should inspect project configuration files, particularly .vscode/tasks.json, for instructions that download or execute additional content, and should be cautious about opening unfamiliar projects from directories previously designated as trusted.

Authorities said a computer suspected of compromise should be disconnected from the internet to interrupt external communications. Because information may already have been stolen before malware is detected, simply removing the malicious program may not be sufficient. In cases involving cryptocurrency wallets, the advisory recommends treating potentially exposed wallet information as compromised and moving assets to a newly created wallet on a separate device.

The agencies also recommend backing up essential information and fully resetting affected operating systems where persistent malware may remain. From an enterprise perspective, incident response should extend beyond the initially compromised developer workstation to credentials, access tokens, source-code repositories, cloud accounts and other systems the user was authorized to reach.

The investigation produced additional evidence about how WaterPlum operators manage the social-engineering portion of attacks. Authorities said actors have used AI-based face-swapping software during online interviews, sometimes disabling video after several minutes and asking targets to do the same while citing network problems. Investigators also observed the use of machine-translation services and text-to-speech tools.

Those details highlight the convergence of generative and synthetic-media technologies with established social-engineering methods. For technology companies, video presence alone can no longer provide strong identity assurance when recruiting remote workers or interacting with purported recruiters. Verification increasingly depends on multiple signals, including employment history, technical performance, identity controls, device information and network behavior.

The multinational nature of the September 18 disclosure is also significant. The United States, Japan, Australia and Germany are presenting WaterPlum not as an isolated cryptocurrency-theft operation but as part of a broader North Korean cyber and overseas IT-work ecosystem. Japan’s National Police Agency said the underlying findings were developed through investigations and analysis by Japanese cyber police, the FBI and private-sector partners. Japan’s Foreign Ministry said the country would continue coordinating with allied and like-minded governments and industry to address North Korean malicious cyber activity.

For the technology sector, the immediate implication is that recruitment workflows now need many of the same security controls applied to software suppliers and external contractors. A coding assessment obtained during an interview can carry software-supply-chain risk; an apparently routine repository can act as a malware-delivery channel; and a developer compromised outside normal working hours can become a route into corporate infrastructure.

The WaterPlum campaign demonstrates how attackers can take advantage of the interconnected nature of modern technology work. Developers routinely install packages, test projects, authenticate to multiple cloud services and handle high-value credentials. That combination makes them attractive targets even when the ultimate objective is financial theft rather than traditional corporate espionage.

Authorities cautioned that the techniques described in the advisory represent observed examples rather than a complete inventory of WaterPlum activity. The operators are expected to continue changing infrastructure, malware and social-engineering methods. The central defensive message is therefore broader than blocking a particular package or malware family: companies and individual developers need to treat unsolicited recruiting activity, external coding projects and remote hiring infrastructure as security-sensitive environments rather than automatically trusted parts of the employment process.