The North Korean hacking group known as WaterPlum, or Contagious Interview, has compromised at least 30,000 devices across more than 100 countries. By posing as recruiters for legitimate firms in the crypto, AI, and NFT sectors, the group successfully stole at least $10.7 million in digital assets.
The attackers targeted software developers and IT specialists through social media and freelance platforms. Victims were prompted to download malicious files disguised as coding tasks or software fixes, which granted the hackers backdoor access to their systems via remote-access trojans and infostealing malware.
Between December 2025 and July 2026, the group extracted funds or credentials from over 7,000 cryptocurrency wallets. Authorities from Japan, Germany, Australia, and the US issued a joint advisory linking these activities to North Korea's Munitions Industry Department.
Beyond direct theft, the campaign allows the group to steal identity documents for impersonation and potential extortion. In one instance, a suspected North Korean operative attempted to secure an engineering role at a Japanese crypto exchange, while another was briefly hired as a consultant by Consensys.
