North Korean hacking group WaterPlum stole at the very least $10.7 million by posing as recruiters for legit crypto and AI firms, attacking unsuspecting job seekers with malware.
The group, often known as Contagious Interview, targets software program builders and IT professionals worldwide, in accordance to a joint advisory from Japan, Germany, Australia and the US. Authorities stated the pretend recruiters impersonated legit AI, cryptocurrency or non-fungible token (NFT) firms and likewise used recruiting providers.
“The first targets had been particular person net designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 applied sciences,” they added.
The advisory additionally hyperlinks WaterPlum to North Korea’s broader marketing campaign of inserting IT employees inside overseas firms, with Japanese and US authorities assessing that WaterPlum actors and a few North Korean IT employees function below North Korea’s Munitions Business Division.
In response to the advisory, WaterPlum lured job seekers by means of social media platforms, on-line job platforms, gig work platforms or freelance marketplaces. Throughout the recruitment course of, victims had been instructed to obtain and execute malicious information disguised as coding assignments or fixes for video-conferencing errors.
Associated: North Korea utilizing overseas expertise to assist infiltrate US firms: Report
As soon as the cyber actors obtained backdoor entry to a sufferer’s pc, they used remote-access trojans and infostealing malware to exfiltrate delicate knowledge and cryptocurrency.
Profitable infections additionally create alternatives for WaterPlum actors to infiltrate organizations that make use of the unsuspecting builders.
WaterPlum contaminated at the very least 30,000 units in additional than 100 nations, with funds or account credentials extracted from over 7,000 cryptocurrency wallets between December 2025 and July 2026.
Nonetheless, the injury can prolong past stolen cryptocurrency. Stolen id paperwork enable North Korean IT employees to impersonate victims and earn earnings, and delicate data might be used for extortion, it stated.
The advisory described a case through which a suspected North Korean IT employee utilized for an engineering function at a Japanese crypto change utilizing a solid resume. The change rejected the applicant after discovering discrepancies through the interview, together with an incapability to elucidate the talents listed in his resume intimately.
A more moderen case occurred in July, when Cointelegraph reported that Consensys had unknowingly engaged a North Korea-linked developer as a marketing consultant. The corporate instructed Cointelegraph it terminated their entry after discovering the risk, and an investigation discovered no theft of belongings or knowledge, malicious code deployment or affect on person security.
The reported marketing campaign is the newest instance of North Korea’s persistent use of cryptocurrency theft to lift funds regardless of years of warnings and enforcement. The FBI blamed North Korea for the $1.5 billion Bybit theft in February 2025, whereas US authorities have warned about its undercover IT employees since at the very least 2018.
Journal: North Korea drives onchain malware surge, CoinEx shuts: Asia Specific
