Authorities from four countries have released a joint warning detailing operations by WaterPlum, a North Korean hacking collective that compromised no fewer than 30,000 devices globally between December 2025 and July 2026. The investigation, conducted by law enforcement agencies in Japan, the United States, Australia, and Germany, determined that the group successfully transferred more than $10.7 million in cryptocurrency assets to North Korea during this period.
WaterPlum operates as part of a larger ecosystem of North Korean threat actors engaged in financially motivated cybercrime designed to generate revenue for the regime and support its weapons development programs. The group is associated with a prolonged campaign dubbed "Contagious Interview," which has repeatedly targeted job seekers using malicious packages distributed through npm.
The attackers typically pose as recruiters or representatives of legitimate companies in the artificial intelligence, cryptocurrency, and NFT sectors. They contact prospective victims through job boards and freelance platforms, then conduct fake interviews where they request that targets download projects, resolve simulated video conferencing issues, or run code samples.
The advisory identifies five distinct malware families deployed by WaterPlum:
- BeaverTail: JavaScript-based malware hidden within npm packages
- InvisibleFerret: A Python backdoor
- OtterCookie: JavaScript remote-access trojan and credential harvester
- OtterCandy: Malware combining OtterCookie functionality with remote-access capabilities
- StoatWaffle: Modular Node.js malware delivered via compromised Visual Studio Code projects that executes code when a folder is opened and marked as trusted
Upon successfully compromising a device, WaterPlum operators work to extract browser credentials, clipboard data, keystroke logs, cryptocurrency private keys and recovery phrases, and stored documents. The group also captures screenshots and may leverage compromised machines to gain access to employer or client networks, enabling further theft of intellectual property and espionage activities.
WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets
the advisory
WaterPlum actors have transferred 1.7 billion Japanese yen (JPY) (equivalent to 10.71 million USD) of cryptocurrency assets to the Democratic People's Republic of Korea (DPRK)
the advisory
Investigators have established direct links between WaterPlum operations and North Korea's illicit IT worker schemes. The advisory notes that some WaterPlum operatives simultaneously work as remote IT professionals providing web development services to clients, and that both groups have utilized identical IP addresses. Additionally, North Korean IT workers have reused identity documents stolen during WaterPlum attacks to assume victims' identities and secure employment.
During video interviews, WaterPlum actors employ AI-powered face-swapping technology to create convincing video feeds. When questioned or when technical issues arise, they disable their cameras and attribute the problem to network connectivity.
The FBI and Japanese police have assessed that WaterPlum actors and certain North Korean IT workers operate under the country's 313 General Bureau, a division within the Munitions Industry Department that oversees weapons research and manufacturing. Japan's National Police Agency announced that authorities have for the first time identified, investigated, and shut down a North Korean IT-worker "laptop farm" operating within the country, uncovering evidence that hundreds of millions of yen had been transferred internationally.
Defensive recommendations
The advisory urges organizations to implement stricter verification procedures for job applicants, including thorough identity confirmation, location validation, and credential assessment. Companies should also enforce the principle of least privilege, granting new hires access only to systems and data necessary for their assigned duties.
For developers, the guidance recommends avoiding execution of unfamiliar code outside isolated sandbox environments. Teams should carefully review all provided files and code for commands that retrieve additional payloads or perform suspicious operations.