Breach · Supply Chain

North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide Through Fake Job Interviews

September 21, 2026 · 4 min read

A North Korean hacking group known as WaterPlum, also tracked under the name Contagious Interview, spent roughly eight months compromising developer workstations through a scheme built around fake job offers and rigged coding tests. By the time a joint advisory from the FBI, Australia's ACSC, Japan's National Police Agency, the US Department of Defense Cyber Crime Center, Germany's BND and BfV, and Japan's National Cybersecurity Office landed on September 18, 2026, the group had infected at least 30,000 devices across more than 100 countries and had transferred at least $10.71 million in stolen cryptocurrency back to North Korea. The method was patient, targeted, and effective against a population (software developers) that tends to assume technical competence is its own protection.

What actually happened

WaterPlum actors reached out to developers on LinkedIn, GitHub, and freelance platforms with convincing job offers. When a target expressed interest, the actors scheduled an interview and asked the candidate to complete a coding test. The test itself was the payload. Victims were directed to clone a repository or install an npm package, run the code locally, and demonstrate it working. What they were actually running included malicious npm packages and VS Code projects with weaponized .vscode/tasks.json files that executed malware silently in the background.

The campaign deployed five named malware families. BeaverTail is a JavaScript infostealer hidden inside npm packages. InvisibleFerret is a Python-based backdoor. OtterCookie is a JavaScript remote access tool and infostealer. OtterCandy and StoatWaffle round out the toolkit. Cybersecurity firm Socket tracked 26 malicious npm packages tied to this campaign. Once a device was compromised, the malware targeted cryptocurrency wallets, and across the full campaign WaterPlum drained approximately 7,000 of them. The actors also used AI face-swapping technology during video calls to further disguise their identities from suspicious targets.

The FBI and Japan's NPA assess that WaterPlum operates under the 313 General Bureau of the Munitions Industry Department, which is subordinate to the Central Committee of the Workers' Party of Korea. This is a state-directed revenue generation operation, and the proceeds fund weapons programs. The campaign ran from approximately December 2025 through July 2026 before the joint advisory was published.

Why this should matter to you even if you don’t run WaterPlum (Contagious Interview)

If your organization does not run cryptocurrency wallets or hire software developers, this might look like someone else's problem. That framing is worth reconsidering. The attack surface here is any environment where developers install dependencies from public package registries, clone repositories from external sources, or run code shared by third parties during vendor evaluations, proof-of-concept testing, or onboarding. That describes a wide range of engineering teams, and the npm ecosystem in particular is a dependency chain that touches almost every JavaScript and Node.js shop regardless of industry.

The deeper issue is that the initial infection vector required no vulnerability in the traditional sense. There was no unpatched CVE to remediate. The victim ran the code voluntarily, as part of what appeared to be a legitimate professional interaction. Social engineering at this level of polish, reinforced by AI-generated video personas, means that developer awareness training alone is an incomplete answer. You also need visibility at the endpoint to catch what a developer's eyes cannot.

Organizations that allow developers to run externally sourced code on corporate hardware without sandboxing or behavioral monitoring are carrying a risk that this campaign illustrates clearly. The 30,000 infected devices and 100-plus countries in scope tell you this was not a narrow, targeted operation. WaterPlum cast a wide net and pulled in victims from across the global developer community. Any organization whose employees participate in freelance work, attend technical interviews, or experiment with open-source packages on work machines sits within that net.

The control that would have blunted it

The control category here is incident response, but the prerequisite is endpoint detection. Responding to an incident requires visibility, and BeaverTail and InvisibleFerret are specifically designed to blend into developer tooling environments where Python interpreters and JavaScript runtimes are expected to be active. A well-tuned endpoint detection and response (EDR) solution that profiles behavioral baselines for developer workstations can flag anomalous outbound connections, unexpected process spawning from within VS Code task runners, and unauthorized access to credential stores or wallet files, even when the initiating action looked intentional.

The practical tradeoff is tuning cost. Developer machines generate a lot of noise. Package managers, build tools, and test runners spawn child processes constantly, which means your EDR policy for engineering endpoints needs to be more sophisticated than a blanket block on child process creation. Getting that tuning right requires collaboration between security and engineering teams, and it requires ongoing maintenance as toolchains evolve. That investment is real, and it is ongoing. An EDR deployed with default policies and left unattended will produce either too many false positives to act on or too many gaps to be useful.

On the incident response side, cyber insurers increasingly require documented IR plans that include procedures for compromised developer endpoints specifically, covering server and network incidents as well as workstation scenarios. That means having a playbook for isolating a workstation mid-campaign, preserving forensic artifacts from npm caches and shell histories, revoking any credentials or tokens that were accessible on the affected machine, and notifying affected parties if wallet credentials or customer data were in scope. Organizations that cannot demonstrate these capabilities at policy renewal time are finding coverage terms tightening. The WaterPlum advisory is concrete evidence that regulators and insurers now view developer endpoint compromise as a primary risk category rather than an edge case.

Strondex's endpoint detection product is built to handle the behavioral complexity of developer workstations, with tunable policies that reduce false-positive fatigue while maintaining coverage for the process-spawning and network-egress patterns that campaigns like WaterPlum rely on.