Fake job interview malware infected 30,000 devices worldwide

Fake job interview malware run by the North Korea-linked group WaterPlum infected at least 30,000 devices across more than 100 countries between December 2025 and July 2026, according to a joint advisory issued by authorities in Japan, the United States, Australia and Germany. The advisory says the same operation transferred cryptocurrency worth 10.71 million US dollars to North Korea, and that funds or account credentials were taken from more than 7,000 cryptocurrency wallets. Its figures put the total sent at 1.7 billion Japanese yen.

The campaign is tracked as Contagious Interview, and it reaches people through the job market rather than through a technical flaw in a server. According to the advisory, the attackers pose as genuine artificial intelligence, cryptocurrency or NFT businesses, or they approach candidates through recruiting and freelance platforms. What follows is a fake interview or a coding test, during which the target is told to download a project, to sort out an apparent problem with the video conferencing software, or simply to run a piece of code. One delivery method described in earlier reporting on this campaign is the malicious npm package: npm is the public library where programmers download ready-made bundles of JavaScript, the language behind most of the web, so a poisoned package can slip in with work that looks entirely normal.

The advisory attributes five malware families to WaterPlum. BeaverTail is JavaScript malware hidden inside npm packages. InvisibleFerret is a Python-based backdoor, meaning a program written in the Python language that leaves a hidden way back into the machine. OtterCookie is a JavaScript remote access trojan and information stealer, software that gives an attacker remote control of a device while copying data out of it. OtterCandy combines OtterCookie with remote access trojan functions. StoatWaffle is described as modular Node.js malware spread through malicious Visual Studio Code projects, and it relies on configuration files that execute code as soon as a folder is opened and trusted. Visual Studio Code is a free code editor used by a great many developers, and it asks the user to trust a folder before its settings take effect, which is the moment this malware abuses.

Once a machine is compromised, the advisory says the attackers go after saved browser credentials, clipboard contents, keystrokes, cryptocurrency private keys and seed phrases, and documents, and they take screenshots as well. A seed phrase is the list of secret words that gives full control of a cryptocurrency wallet, so anyone who copies it can move the funds. The stolen access is not always the end of the story: the advisory notes that the attackers may use a compromised computer to reach the networks of that person's employer or clients, which turns a single infected laptop into a route to intellectual property theft and espionage.

The joint advisory also ties WaterPlum directly to North Korea's fraudulent IT worker operations. It states that some WaterPlum hackers also work as remote IT staff doing web development for clients, and that the two groups have used the same IP addresses. The warning goes further: identity documents stolen in WaterPlum attacks are reused by North Korean IT workers to impersonate the victims and land jobs. Investigators also found that WaterPlum actors use AI face-swapping software during online interviews, then switch their cameras off and blame network problems. The FBI and Japanese police assess that WaterPlum actors and some of these IT workers operate under the country's 313 General Bureau, part of the Munitions Industry Department. Japan's National Police Agency says it identified, investigated and dismantled a North Korean IT worker laptop farm in the country for the first time, a setup of computers used to make one person look like several employees, and found evidence that several hundred million yen had been sent abroad.

For the employers and developers reading this, the advisory's recommendations are specific. Companies should carefully verify the identity, location and qualifications of job applicants, and should limit each person's access to only the systems and data the role actually requires. Developers should not run unknown code outside a sandbox, an isolated space where a program cannot touch the rest of the computer, and should inspect any files or code they are handed for commands that download further payloads.

The pattern here matters to anyone who hires technical help remotely: this attack does not need a broken server or an unpatched website, it needs a person willing to open a project file during a job interview. For teams that bring in outside developers, the access question the advisory raises, who can reach which system and how much data they can see, is the same question that security-first IT, infrastructure and consulting services such as AEU-I are built around, and it is worth answering before the first contractor laptop joins your network.