The WaterPlum group has successfully compromised 30,000 devices by embedding malware into coding tests during fake job interviews. These persistent remote access trojans allow attackers to maintain long-term control over infected systems, which are often used by applicants who later secure legitimate employment at other firms.
The operation has resulted in the theft of $10.7 million in cryptocurrency. Authorities believe these funds are directed to the government of the Democratic People’s Republic of Korea. Beyond direct theft, the group harvests credentials and personal data to facilitate further infiltrations into Western companies.
Fake recruiters target software developers and IT professionals by posing as representatives of legitimate AI, cryptocurrency, and NFT companies. These fraudulent job offers appear on social media, freelance marketplaces, and various online job platforms. Amazon reported blocking over 1,800 suspected North Korean applications between April 2024 and late 2025.
The North Korean government reportedly generates $500 million annually through schemes involving fake IT personnel embedded in legitimate organizations. Experts recommend that job seekers use isolated virtual machines for interviews and verify job openings directly with companies to mitigate the risk of infection.
