DPRK WaterPlum fake job campaign hit 30,000 devices

A seven-agency law enforcement advisory has put hard numbers on a threat that has been quietly hollowing out developer teams for years. North Korea's WaterPlum hacking group compromised at least 30,000 devices across more than 100 countries between December 2025 and July 2026, exfiltrated credentials or funds from over 7,000 cryptocurrency wallets, and transferred roughly USD 10.7 million in stolen cryptocurrency to the DPRK. The advisory, published on September 18, 2026, marks the first time government authorities have attached concrete scale to the campaign, and the numbers should reset how you think about hiring, onboarding, and the safety of the code running inside your build rooms.

The threat is not a zero-day in a dependency. It is a social engineering pipeline that ends with a backdoor on a developer's laptop.

The joint advisory came from Japan's National Police Agency and National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's Signals Directorate, and Germany's BND and BfV. Germany's domestic intelligence service confirmed that the campaign has targeted software developers inside Germany as well, making clear this is not a far away problem confined to a handful of victim companies. If your organization hires freelance developers, uses take-home coding tests, or pulls code from GitHub and Bitbucket as part of your interview process, this advisory is aimed directly at you.

What is WaterPlum and how does the attack actually work?

WaterPlum is the name authorities have assigned to a North Korean threat group publicly tracked under the campaign label "Contagious Interview." The group has been active for multiple years, but until now the public record lacked official confirmation of its reach. The advisory changes that.

The attack chain is consistent and well-documented. WaterPlum operators pose as recruiters, frequently impersonating AI, cryptocurrency, or NFT companies, and also use legitimate freelance and recruiting platforms to approach software developers and IT professionals. The lure is a technical interview or a take-home coding assignment. Victims are told to download and run files hosted on collaboration platforms and code repositories to complete a coding assignment or troubleshoot a supposed error. Those files carry one of five named malware families, several of which will be familiar to teams that track supply chain threats.

The five malware families linked in the advisory are:

• BeaverTail: a JavaScript loader concealed inside npm packages, hosted on GitHub or Bitbucket repositories that look like legitimate interview projects.
• InvisibleFerret: a Python-based backdoor that provides persistent remote access to the compromised machine.
• OtterCookie: a JavaScript remote access trojan and information stealer that has previously been documented by Elastic using SVG steganography techniques.
• OtterCandy: a newer variant combining OtterCookie with additional RAT capabilities.
• StoatWaffle: a modular Node.js loader, credential harvester, and RAT that hides inside blockchain-themed decoy VS Code project repositories and auto-executes through a malicious VS Code configuration file the moment the victim opens and trusts the folder.

Once a machine is compromised, the attackers harvest browser-stored credentials, clipboard contents, keystrokes, screenshots, cryptocurrency wallet data, and private keys. The access also lets operators pivot laterally into the victim's employer or client networks, expanding from financial theft into intellectual property theft and espionage.

How does WaterPlum connect to the DPRK IT worker scheme?

This is where the advisory moves from a single campaign warning into something structurally more serious. The FBI and Japanese police assess that both WaterPlum cyber actors and some North Korean IT workers operate under the country's 313 General Bureau, which is part of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea. That bureau is responsible for North Korea's weapons research and production. The two operations share a parent organization and, in some cases, share the same IP addresses.

The connection runs deeper than shared infrastructure. The advisory states that some WaterPlum hackers also work as remote IT workers performing web development for clients, and that the two groups have used the same IP addresses. North Korean IT workers then reuse identity documents stolen in WaterPlum attacks to impersonate victims and obtain legitimate jobs. Japan's National Police Agency also disclosed that authorities identified, investigated, and dismantled a North Korean IT-worker "laptop farm" in the country for the first time, finding evidence that several hundred million yen had been transferred abroad.

A laptop farm is a facility where an enabler physically hosts employer-issued laptops and remotely operates them on behalf of North Korean workers. The fact that one was dismantled inside Japan, and that it was moving the equivalent of hundreds of millions of yen in cryptocurrency, should sharpen your hiring risk model. This is not a theoretical threat to remote work infrastructure. It is an active, monetized operation.

The advisory also records two prior cases of IT-worker escalation that go beyond simple wage fraud. In one case, a North Korean IT worker extorted an employer over its own source code after a payment dispute. In another, a worker defaced and disabled a hiring company's website. These are not hypothetical escalation scenarios. They are documented incidents that began with a fraudulent hiring process and ended with operational damage to the victim company.

If you have not yet reviewed how your organization handles remote contractor identity verification, this advisory is your signal. You can read more about how AI coding agent malware hides in clean GitHub repos to understand a related supply chain vector that targets the same build environments.

What detection signals should I hunt for?

The triage challenge with WaterPlum is that the attack looks like normal developer activity at the process level. Node, npm, python, and VS Code are all standard tools. The distinguishing context is timing correlation with an active job interview or coding test process, not the presence of the tools themselves.

BeaverTail, InvisibleFerret, and OtterCookie-family execution shows up as a node or python process spawned from an IDE or terminal session shortly after a new project folder is opened or an npm install completes. This is followed by outbound connections to non-corporate destinations and API calls against browser credential stores or the clipboard. Legitimate build tooling does not read browser credential stores or poll the clipboard.

StoatWaffle's variant follows the same pattern but adds a VS Code auto-run entry. A .vscode configuration file fires on folder open and trust in a freshly cloned, blockchain-themed repository that your organization's ticketing system has no record of. If a developer cloned a repo as part of an interview process and a .vscode/tasks.json file executed code immediately upon trust, that is a high-fidelity signal.

Key indicators to hunt for:

• node or python processes spawned from an IDE session shortly after npm install or folder trust events, followed by outbound connections to non-corporate infrastructure.
• Processes reading browser credential stores (Chrome Login Data, Firefox logins.json) or polling the clipboard API from a build or test context.
• .vscode configuration files in freshly cloned repositories that execute commands on folder open, particularly in repos with blockchain, crypto, or NFT themes.
• Outbound connections from developer workstations to unfamiliar domains following the onboarding of a new contractor or the start of a recruiting cycle.

The timing correlation matters. If you see these signals in isolation, they may be noise. If you see them within 48 hours of a contractor onboarding or a take-home coding test being run, treat them as presumptively malicious until proven otherwise.

What should my team do about this right now?

This is a social engineering-led initial access vector, not an exploited vulnerability. The controls are procedural rather than patch-based, which means your security team cannot solve this with a patch cycle. It requires coordination between security, recruiting, and engineering management.

For recruiting and HR:

• Never let a candidate run unreviewed take-home assignment code with credentials or production access. If you use coding tests, review the repository before the candidate touches it and sandbox the execution environment.
• Verify a remote contractor's identity documents against known facilitator and laptop-farm patterns before onboarding. The advisory explicitly warns companies to carefully verify job applicants' identities, locations, and qualifications.
• Watch for behavioral flags documented in the advisory: camera avoidance during interviews, audio lag consistent with a second monitor being read from, and insistence on cryptocurrency payment.

For engineering and security:

• Developers should avoid running unknown code outside a sandbox. Inspect provided files and code for commands that fetch additional payloads, particularly in postinstall scripts and VS Code configuration files.
• Restrict remote contractor access to only the systems and data required to perform their jobs. The advisory is explicit on this point, and it is the single most effective control against lateral movement if a contractor machine is compromised.
• Alert on node or python processes that access browser credential stores or clipboard APIs in the context of a freshly cloned repository.
• Block or alert on .vscode/tasks.json and .vscode/launch.json files that execute shell commands on folder open in repositories that originate outside your organization.

For leadership:

• Assume that if you hire freelance or contract developers through open platforms, you are in the threat model. Germany's BfV confirmed the campaign targets developers inside Germany, and the 100-country footprint means geography is not a meaningful filter.
• Review your source code access controls. The advisory documents a case where a North Korean IT worker extorted an employer over its own source code. If a contractor has access to your full repository and no segregation of duties, you are carrying that risk.
• Talk to your recruiting team about the interview process. If candidates are asked to clone repositories and run code on their own machines as part of a coding test, you need a sandbox policy and a review step before execution.

The real attack surface is your hiring pipeline

A 30,000-device campaign that moves $10.7 million and is tied directly to a weapons production bureau is not a background threat. It is a sustained, state-level operation that has found a gap most companies have not closed: the space between recruiting, onboarding, and production access. WaterPlum exploits the fact that developers run untrusted code as a normal part of interviews and contract work, and that organizations treat contractor onboarding as a lighter security event than full-time hiring. The advisory gives you the numbers and the malware names. The defensive work is yours.

Sources

• bleepingcomputer.com - North Korean WaterPlum hackers infected 30,000 devices worldwide
• ctipilot.ch - CTI Daily Brief, 2026-09-19
• elastic.co - Elastic Security Labs, OtterCookie research
• bundesamt-fur-verfassungsschutz.de - German Federal Office for the Protection of the Constitution