Fake job interviews used by the North Korean group WaterPlum infected at least 30,000 devices in more than 100 countries, according to a joint advisory released on September 18. The trap was a task that looked relevant to getting hired: run a coding project, or fix a problem with the interview’s video call. Doing that gave the supposed employer access to the applicant’s computer.
The findings cover activity from around December 2025 through July 2026, rather than 30,000 new infections this week. Agencies in Japan, the United States, Australia and Germany attribute the operation, also known as Contagious Interview, to North Korean actors. They report at least ¥1.7 billion, approximately $10.71 million, in cryptocurrency stolen on North Korea’s behalf.
A technical test becomes an access request
WaterPlum approaches developers, web freelancers and other IT professionals through social networks, job platforms and freelance marketplaces. Operators impersonate legitimate AI, cryptocurrency or NFT businesses. An attractive vacancy supplies the reason for contact; a technical interview supplies the reason to execute unfamiliar code.
The advisory describes two delivery pretexts: completing a coding assignment and troubleshooting a video-conferencing error. Malicious files arrive through code repositories and collaboration platforms. A familiar hosting service does not establish who wrote the project or what its startup code will do.
The report names BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle among the malware used. After the initial loader creates access, remote-access trojans maintain a connection and information stealers collect data. Browser credentials, clipboard contents, screenshots, wallet keys and identity documents are among the targets. Our earlier account of OTTERCOOKIE hidden in a working coding exercise shows one specific delivery method; the new advisory documents the wider operation and its measured scale.
The folder-trust decision matters
StoatWaffle provides a particularly concrete example. The agencies describe blockchain-themed Visual Studio Code projects containing a malicious configuration that can trigger code execution when the project is opened and trusted. The relevant boundary is permission to run project code, not whether the repository looks professionally assembled.
Keep unfamiliar projects in Restricted Mode while inspecting them. The advisory specifically calls out .vscode/tasks.json and warns against placing an unknown project inside a folder already marked as trusted. Microsoft’s documentation explains that Restricted Mode limits tasks and other features that can execute code. It is a review boundary, not a guarantee that a project is harmless.
For an assignment that genuinely requires execution, the agencies recommend an isolated sandbox or virtual machine instead of a computer holding personal information or cryptocurrency assets. Verify the recruiter through the employer’s independently located contact details before allowing interview pressure to decide what runs on your machine.
Stolen identities connect the two sides of hiring
The advisory also connects WaterPlum with North Korean IT workers who seek employment themselves. Investigators found the same IP addresses used for accessing laptop farms, using crowdsourcing services and applying to a Japanese cryptocurrency exchange. The NPA and FBI assess that WaterPlum and some North Korean IT workers operate under the same North Korean bureau.
A laptop farm gives a remote worker access to computers hosted by an intermediary, helping conceal the worker’s actual location. Japanese authorities say they dismantled one such operation for the first time in Japan. Stolen identity documents can support further impersonation, while stolen developer credentials can expose employers or clients. These are overlapping activities; the report does not say that all 30,000 infected devices formed that laptop farm.
The wallet count also needs care: the agencies report funds or account credentials taken from more than 7,000 wallets. That is not a finding that every one of those wallets was emptied. The separately reported cryptocurrency total describes theft; the credential count captures an additional form of exposure.
Removing a file does not recover an identity
If a suspicious interview project already ran, stop using the affected machine for sensitive work and disconnect it. Preserve the recruitment messages and repository details, and involve your security team if work credentials were present. The advisory warns that data may already have left the device even after malware removal; it recommends recovering from a separate device, replacing exposed wallet material and resetting the affected operating system.
For Windows users assessing remaining malware, the fake-interview cleanup guide explains Gridinsoft Anti-Malware scanning and the separate recovery of accounts, sessions and developer secrets. A scan can help find malicious components; it cannot retract copied credentials or replace the advisory’s recovery steps.
The revealing feature of this campaign is how ordinary the requested action sounds. A coding exercise is still code from another party. Treating the recruitment process as proof of trust lets a stranger turn a job application into access to a much more valuable working environment.
References
- NPA, NCO, FBI, DC3, ASD’s ACSC, BND and BfV. WaterPlum and North Korean IT-worker activities. Joint advisory, September 18, 2026.
- Microsoft. Workspace Trust. Visual Studio Code documentation, accessed September 20, 2026.
