A recruiting funnel built to deliver malware
WaterPlum is a North Korean hacking group tied to the country's 313 General Bureau, part of the Munitions Industry Department, which means its financially motivated attacks fund weapons development rather than ordinary cybercrime profit. Its signature operation, tracked as Contagious Interview, has run for years, but the scale disclosed this week is striking: at least 30,000 infected devices across more than 100 countries between December 2025 and July 2026. The group works by posing as legitimate AI, cryptocurrency, and NFT companies on recruiting and freelance platforms, luring job seekers and freelance developers into what looks like a normal hiring pipeline.
The tell is in the delivery mechanism. Candidates are walked through a fake interview process that culminates in a coding test, delivered as a malicious npm package or Visual Studio Code project, and running it executes the payload. Researchers also documented WaterPlum using AI face-swapping software during live video interviews to present a fabricated interviewer, then disabling the camera partway through and blaming network problems, a small but telling detail about how commoditized synthetic media has become for even routine social engineering, not just headline deepfake fraud.
What the malware actually takes, and where the money goes
Once installed, the campaign's malware family, which includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, harvests browser credentials, clipboard contents, keystrokes, and cryptocurrency private keys and seed phrases, along with documents and screenshots. More than 7,000 crypto wallets were compromised, and researchers traced roughly $10.71 million (1.7 billion Japanese yen) in stolen cryptocurrency moved to North Korea over the campaign window. That is a meaningful, ongoing revenue stream for a sanctioned state, not a one-time smash and grab.
The second-order risk is what happens after the personal device is compromised. WaterPlum's tooling is built to pivot from an individual's machine into their employer's network once the victim is hired or already employed, targeting intellectual property and internal systems rather than stopping at the initial credential theft. That makes this campaign a direct enterprise risk, not just a personal cybercrime problem, because it specifically targets IT professionals and developers, the people most likely to hold both a personal crypto wallet and privileged access to company code and infrastructure at the same time.
Why this keeps working
Contagious Interview has been public knowledge for well over a year, and it keeps working anyway, which says more about hiring workflows than about any single technical control. Job seekers and freelancers are conditioned to run whatever code a prospective employer sends them, on whatever timeline the recruiter sets, precisely because refusing looks uncooperative during a hiring process. That social dynamic is harder to patch than a CVE, and North Korean operators have clearly identified it as a durable, low-cost initial access vector that does not depend on a zero-day or a phishing click, just a plausible job posting.
The scale here, 30,000 devices and eight months of sustained operation, also suggests this is now industrialized rather than opportunistic. Multiple malware families, AI-assisted interview theater, and freelance-platform targeting all point to a mature operation with dedicated tooling, not a one-off scam campaign. Enterprises with distributed engineering teams, especially those that hire contractors through freelance marketplaces, are the most exposed, because the vetting rigor applied to full-time hires rarely extends to contract developers pulled in for a sprint.
Part of a wider North Korean revenue machine
Contagious Interview does not operate in isolation. It sits alongside North Korea's better-known IT worker fraud scheme, where operatives use stolen or fabricated identities to land legitimate remote developer jobs at Western companies and funnel their salaries back to the regime, and alongside more traditional exchange-hacking operations. WaterPlum's campaign is the inverse of the IT worker scheme: instead of North Koreans posing as job applicants, it poses as the employer, but both exploit the same remote-hiring trust gap and both fund the same weapons programs. Treating them as separate problems misses that they are two arms of the same state-directed revenue strategy.
The scale reported here, 30,000 devices and over $10 million, is also consistent with broader estimates that North Korean cyber operations now generate a meaningful share of the regime's foreign currency income, alongside sanctioned arms sales and other illicit trade. That context matters for how seriously enterprises should weigh this threat: this is not a criminal group chasing quick payouts that might get bored and move on. It is state-directed, well-funded, and has every incentive to keep refining a technique that has already proven durable across multiple years and malware generations.
What this means for hiring and endpoint policy
The practical fix sits at the intersection of HR and security, which is an uncomfortable place for most policies to live. Technical coding assessments for external candidates and contractors should run in sandboxed, disposable environments rather than on a device with access to real credentials or crypto wallets, and recruiting teams need a documented escalation path when a candidate is asked to run unreviewed code. Security teams should brief hiring managers and recruiters directly on this pattern, since they are the ones fielding the initial outreach and are unlikely to recognize a malicious coding test on their own.
For CISOs managing distributed or contractor-heavy engineering organizations, this is a case for extending endpoint detection and application allowlisting to any device used in a hiring or vetting process, not just standard employee laptops. It also strengthens the argument for isolating personal cryptocurrency activity from any device that touches company systems, a policy many organizations still leave unwritten. The cost of getting this wrong is not hypothetical: WaterPlum has already proven it can convert a fake job posting into millions of dollars and a foothold inside a real company's network.
