The agencies say WaterPlum, also known as Contagious Interview, extracted cryptocurrency funds or account credentials from more than 7,000 wallets and moved at least ¥1.7 billion, or $10.71 million, in cryptocurrency to North Korea between roughly December 2025 and July 2026. CyberScoop independently reported the warning’s global scope and the agencies’ assessment that the activity is tied to North Korea’s broader overseas IT-worker operation.
The supplied account describes 7,000 wallets as having been “raided.” The primary advisory is more precise: it says the attackers obtained funds or account credentials from more than 7,000 wallets. That distinction matters for incident response. A wallet whose seed phrase, private key, browser session, or extension data was copied may be compromised even when its balance has not yet moved.
A coding assignment became the initial-access mechanism
WaterPlum’s lure is tailored to people most likely to execute code without treating that action as exceptional: web developers, software engineers, freelancers, and specialists in cryptocurrency, blockchain, and Web3 work. Operators impersonate prospective employers, including AI, crypto, and NFT companies, and contact targets through social networks, recruiting services, job boards, gig platforms, and freelance marketplaces.
The attack progresses during an interview or take-home assessment. A candidate may be told to download a project from GitHub, Bitbucket, or another developer collaboration service; install a dependency; run an NPM command; or troubleshoot a supposed fault in the interview’s video-conferencing software. The request is credible precisely because it resembles an ordinary technical screen.
The joint advisory names BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle among the malware families embedded in malicious NPM packages and development projects. Their roles vary, but the operational result is consistent: initial execution gives the attackers a path to install information stealers and remote-access tooling, retain access, and move beyond the original task.
For Windows users, one particularly consequential detail involves Visual Studio Code. Authorities say StoatWaffle can hide in blockchain-themed VS Code projects and use a malicious .vscode/tasks.json configuration to trigger code execution when a victim opens and trusts the folder. A developer who clicks “Yes, I trust the authors” to dismiss VS Code’s Workspace Trust prompt may therefore be granting an unfamiliar repository permission to execute its setup logic.
Workspace Trust is a security boundary, not a nuisance dialog. It should remain enabled on machines used for development, and unknown projects should be opened in Restricted Mode until their task definitions, package scripts, extensions, and dependency-install instructions have been inspected.
The theft is designed to outlive the interview
The publicized cryptocurrency losses are only the visible part of the exposure. Once a Windows computer is backdoored, WaterPlum can seek browser-stored authentication data, clipboard contents, keystrokes, screenshots, private keys, seed phrases, identity documents, and files accessible through local or shared folders.
The advisory also says remote-access trojans are used to maintain connectivity, persistence, and routes to pivot across a victim environment. In practical terms, the risk does not end when an antivirus product quarantines the initial loader. If a candidate used the same computer to access GitHub, Azure, Microsoft 365, cloud consoles, password managers, source-control systems, internal VPNs, or customer environments, those accounts and sessions require review.
The agencies explicitly warn that a compromised developer can become an entry point into a future employer, client, or contracting partner. This is an important point for IT administrators: the device at risk may belong to a jobseeker today but be used for corporate work tomorrow. The attacker’s objective can expand from draining a personal wallet to stealing source code, collecting identity material for another impersonation, accessing a new organization, or extorting a victim with exfiltrated data.
This makes conventional “bring your own device” onboarding a larger concern. A new contractor’s Windows laptop should not receive production credentials, repository access, or privileged cloud roles simply because the person has passed a hiring process. Device health checks, endpoint detection and response enrollment, phishing-resistant authentication, limited initial permissions, and staged access are useful safeguards against both this recruiter lure and a pre-compromised endpoint arriving with a legitimate new hire.
WaterPlum and the fake-worker operation overlap
The advisory joins two North Korean revenue-generation threats often discussed separately: malware campaigns that impersonate recruiters and fraudulent remote workers who seek jobs at foreign companies under false identities. The National Police Agency of Japan and the FBI assess that WaterPlum operators and some North Korean IT workers operate under the 313 General Bureau of North Korea’s Munitions Industry Department.
The connection is supported by operational overlap rather than a broad thematic claim. Authorities say WaterPlum actors and North Korean IT workers used the same IP addresses while accessing laptop farms, using crowdsourcing services, and applying for positions at a Japanese cryptocurrency exchange.
A laptop farm is a collection of employer-issued or employment-related computers located at an enabler’s residence and remotely controlled by workers elsewhere. The setup supplies a domestic-looking endpoint and network presence while hiding the worker’s actual location. The joint advisory says Japanese authorities dismantled such a farm for the first time in Japan and found evidence that the group transferred several hundred million yen in cryptocurrency abroad.
For employers, this means recruitment security and endpoint security cannot be separated cleanly. A company can face two directions of risk: a fake recruiter can infect an employee or applicant, while a fake applicant can gain legitimate access from inside the organization. In both cases, the useful controls are similar—identity verification, controlled device enrollment, least privilege, session monitoring, and a willingness to investigate anomalies before expanding access.
The advisory describes warning signs observed in suspected North Korean IT-worker applications, including implausibly broad skill claims, inconsistent language ability, resistance to in-person meetings, payment requests in cryptocurrency, frequent video or audio freezes, background voices, and signs that an applicant is reading responses from another display. None is proof by itself. Together, especially when location, résumé history, phone data, and technical performance do not align, they justify a deeper verification process.
The public warning gives defenders behavior, not huntable indicators
The agencies provide useful behavioral guidance, but the nine-page public advisory does not include the IP addresses, malicious package names, file hashes, domains, wallet addresses, or YARA-style detection content that many enterprise security teams would need for a direct retrospective hunt. It names malware families and techniques, but it does not give a ready-made list that administrators can paste into an EDR or SIEM query.
That omission changes the operational priority. Organizations should not wait for a blocklist to determine whether they are exposed. Instead, security teams should investigate the behaviors the advisory does disclose:
- Review developer endpoints for recently opened repositories, NPM installs, or interview projects obtained through unsolicited recruiting contacts.
- Hunt for suspicious child processes launched by
Code.exe,node.exe, PowerShell, Windows Script Host,mshta.exe, or command shells shortly after a project folder was opened or dependencies were installed. - Review
.vscode/tasks.json,package.jsonlifecycle scripts, and setup documentation in unfamiliar repositories for encoded PowerShell, hidden execution, unexpected downloads, or commands that fetch and run additional files. - Check browser extension inventories, credential-store access, unusual archive creation, clipboard collection behavior, and outbound connections from developer workstations following recruiting activity.
- Treat access to software wallets, seed phrases, browser-held credentials, and cloud or source-code tokens as potential data theft, rather than waiting for proof that cryptocurrency has moved.
The advisory specifically flags strings such as curl, base64, -enc, mshta, Invoke-WebRequest, iwr, and hidden as reasons to stop and understand a script before running it. Those terms are not inherently malicious; legitimate automation uses some of them. Their importance here is contextual: a recruiter-requested project that hides its logic, downloads an executable payload, or asks a candidate to bypass normal controls is not a reasonable technical assessment.
What to do after a suspected malicious interview task
The official advice is more severe than simply removing a suspicious package. If a developer believes they executed an interview project or downloaded a loader tied to the campaign, disconnect the Windows machine from the network immediately to cut off command-and-control access. Preserve enough evidence for an investigation, but do not continue using the device for logins, wallet transactions, or code work.
Credential resets should occur from a known-clean system. That includes corporate passwords, Microsoft 365 sessions, VPN access, GitHub or Azure DevOps tokens, SSH keys, cloud credentials, browser-synced passwords, API tokens, and password-manager recovery material. Revoke active sessions and rotate secrets that may have been visible on the endpoint, including development and CI/CD credentials.
For cryptocurrency exposure, the advisory recommends creating a new wallet on a separate device, moving assets to it, and storing the new seed phrase offline. It also recommends a full operating-system reset because malware that escaped detection may remain. For an enterprise-managed Windows device, a wipe and redeployment from a trusted image is generally safer than trusting a cleanup after a confirmed or credible backdoor event.
WaterPlum’s campaign succeeds by exploiting a professional reflex: developers are expected to run code to demonstrate skill. The defensible change is not to stop interviewing candidates with technical work. It is to move that work into isolated virtual machines, disposable sandbox environments, or company-controlled assessment platforms where untrusted code has no path to browser credentials, wallet extensions, shared folders, production tokens, or an employer’s network.