Key Takeaways
The scale is confirmed. A September 18, 2026 joint advisory from the FBI, Japan's National Police Agency, and partners in Australia and Germany says the North Korea-linked group WaterPlum infected at least 30,000 devices and took funds or credentials from over 7,000 crypto wallets between December 2025 and July 2026.
The attack starts with a job offer, not a phishing email. The malware arrives through a coding test, a code repository, a VS Code project, or a "fix your video call" download that the fake interviewer asks you to run.
One rule prevents most of the damage. Never run a stranger's code on a machine that holds wallet keys, saved passwords, or work credentials. If you already did, assume your keys are exposed and move your funds from a separate, clean device.
What the September 2026 Advisory Says
On September 18, 2026, seven agencies published a joint advisory about a North Korean cyber group called WaterPlum, which security researchers also track as Contagious Interview. The signers were Japan's National Police Agency (NPA) and National Cybersecurity Office, the US Federal Bureau of Investigation (FBI), the US Department of Defense Cyber Crime Center (DC3), the Australian Cyber Security Centre, and Germany's BND and BfV.
The campaign targets individual tech workers rather than large exchanges. The group poses as employers, often AI, crypto, or NFT companies, and uses the hiring process to get victims to run malicious code.
Metric | Figure reported in the advisory |
|---|---|
Active period | About December 2025 to July 2026 |
Devices infected | At least 30,000 |
Countries affected | More than 100, including the US and Japan |
Wallets affected | Over 7,000 (funds or account credentials taken) |
Crypto moved to North Korea | 1.7 billion yen, about $10.71 million |
Main targets | Web designers, engineers, and crypto, blockchain, and Web3 specialists |
The advisory presents these as minimums. Real totals may be higher because many victims never report.
Who Is WaterPlum?
WaterPlum is not new. Palo Alto Networks' Unit 42 first disclosed the Contagious Interview campaign in November 2023. What changed in 2026 is the confirmed scale and the joint government response.
According to the NPA and FBI, WaterPlum and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, which reports to the Central Committee of the Workers' Party of Korea. The two groups share IP addresses, and stolen ID photos can help IT workers impersonate victims and apply for real jobs. In one case from May 2025, a suspected North Korean applicant used a forged resume to apply for an engineering role at a Japanese crypto exchange. The company spotted the warning signs and did not hire him.
How the Fake Interview Playbook Works
Each step feels normal on its own, which is why the pattern works.
Stage | What the victim sees | What is actually happening |
|---|---|---|
1. Contact | A recruiter message on a job site, freelance marketplace, or social media about a well-paid AI or crypto role | The attacker builds trust using a fake or impersonated company |
2. Interview | A video call, sometimes with a camera that goes off after a few minutes due to "network issues" | The advisory says actors used AI face-swapping software to disguise themselves |
3. Technical task | A request to clone a repository, run a project locally, fix a bug, or troubleshoot meeting software | The project contains a malicious npm package or a booby-trapped configuration file |
4. Execution | You run the app or open the folder in VS Code and click "trust" | Malware installs quietly in the background |
5. Theft | Nothing obvious, at first | A remote access trojan keeps control while an infostealer sends data to the attacker's server |
The key lesson is that the dangerous code is often not in the files you read. It can sit inside a dependency or in a file like .vscode/tasks.json, which VS Code can run automatically once you trust a folder.
The Malware Toolkit
The advisory names five malware families and their variants.
Malware | Type | Role in the attack |
|---|---|---|
BeaverTail | JavaScript, hidden in npm packages | Downloader and information stealer, often pulled from GitHub or Bitbucket |
InvisibleFerret | Python backdoor | Gives remote access to the infected computer |
OtterCookie | JavaScript remote access trojan | Remote control plus data theft |
OtterCandy | Hybrid | Combines features of OtterCookie and RATatouille |
StoatWaffle | Modular Node.js malware | Loader, credential harvester, and RAT delivered through blockchain-themed VS Code projects |
Once inside, the malware targets:
Usernames and passwords saved in web browsers
Clipboard contents, keystrokes, and screenshots
Wallet data, including private keys and seed phrases
Files and shared folders, including photos of passports and driver's licenses
An empty wallet is not safe either. If an attacker has your seed phrase, they can watch the address and drain any funds that arrive later.
Red Flags: How to Spot a Fake Crypto Recruiter
Red flag | Why it matters |
|---|---|
Unsolicited offer with high pay and very little screening | Speed and flattery lower your guard |
The test requires running code on your own computer | Running code is the infection step |
Pressure to "just run npm install" or open a project quickly | Urgency discourages reading the files first |
Interviewer's camera turns off and they ask you to turn yours off | Matches behavior described in the advisory |
A request to download a special meeting app or "fix" your video software | A known delivery method for this campaign |
New company domain, thin recruiter profile, or email that does not match the company | Common signs of impersonation |
Safety Protocol for Take-Home Coding Tests
Rule 1: Never Run a Test on a Machine That Holds Keys
Your daily laptop likely holds wallet extensions, saved passwords, SSH keys, and work logins. That is exactly what this malware steals.
Sandbox Rules
Use a disposable environment. A virtual machine or a throwaway cloud development environment works. The advisory recommends running unknown code only inside a sandbox or virtual machine.
Keep it empty. No wallet extensions, password manager, SSH keys, cloud credentials, browser logins, or shared folders.
Read before you run. Check package.json for install scripts such as preinstall or postinstall, and look for obfuscated or unreadable code.
Watch for risky commands. The advisory flags strings such as curl, base64, -enc, mshta, Invoke-WebRequest -Uri, iwr -Uri, and hidden. Do not run scripts containing them unless you fully understand them.
Open unknown projects in VS Code Restricted Mode. Answer "No" when asked if you trust the authors. Inspect .vscode/tasks.json before trusting anything, and never open a stranger's project inside a folder you already marked as trusted.
Destroy it afterward. Delete the VM or revert to a clean snapshot when the test is done.
A sandbox lowers risk but does not remove it. For long-term protection, keep keys on a hardware wallet and never store a seed phrase as a file, screenshot, or cloud note.
How to Verify a Recruiter
Find the company yourself. Search for its official website and check that the role appears on its real careers page.
Confirm through official channels. Contact the company directly and ask whether the recruiter works there.
Check the details. Look at the email domain, profile age, connection history, and past posts.
Ask for a normal process. Real employers can explain their interview stages and usually offer tests on a hosted platform or as a code review.
Treat refusal as a signal. If the recruiter insists you run their code locally on your own machine, walk away.
What to Do If Malware Already Ran
Assume you are compromised, even if antivirus later removes something. The advisory warns that data may already be gone.
Disconnect the device from the internet right away.
Move your crypto first. On a separate, clean device, create a brand-new wallet, transfer all assets to it, and write the new seed phrase down offline.
Reset your accounts from the clean device. Change passwords, sign out of all sessions, turn on multi-factor authentication, and rotate API keys, SSH keys, and access tokens.
Tell your employer or clients. Your work credentials may give attackers a path into their systems.
Rebuild the machine. Back up only essential files and fully reinstall the operating system.
Report it. In the US, file a report with the FBI's Internet Crime Complaint Center at ic3.gov. Save the recruiter's profile, messages, repository links, and any transaction IDs. Report the fake profile to the job platform too.
How This Scam Compares to Other Crypto Threats
Threat | The hook | What you lose | Core defense |
|---|---|---|---|
Fake job interview | A career opportunity and a coding test | Keys, passwords, work access, ID documents | Never run untrusted code on your main machine |
Pig butchering | A friendly contact who introduces an "investment" | Money deposited into a fake platform | Never invest through strangers or unverified platforms |
Approval phishing | A fake site asks you to sign a token approval | Tokens drained through the approval | Read what you sign and revoke unused approvals |
A Note for Hiring Teams
The advisory warns that paying North Korean IT workers, or helping them with IDs, bank accounts, or remote laptops, may violate local laws and sanctions. Suggested checks include matching IP location to claimed residence, calling listed phone numbers, and probing resume skills in detail. This is general information, not legal advice.
WaterPlum does not break in. It waits for developers to invite the malware in during a normal hiring step. The defense is simple: keep tests away from your keys, verify recruiters independently, and act fast if something goes wrong.
FAQ
What is the Contagious Interview campaign?
Contagious Interview is a long-running North Korea-linked campaign, also tracked as WaterPlum, in which attackers pose as recruiters and trick job seekers into running malware during fake technical interviews.
Is it safe to do a take-home coding test for a crypto job?
It can be, if you run it in an isolated virtual machine or cloud environment with no wallets, passwords, or work credentials. Never run it on the computer where you keep crypto or sensitive accounts.
Does antivirus software protect me from this malware?
Not fully. The advisory says that even after detection and removal, you should assume wallet data may already have been stolen and move funds to a new wallet created on a separate device.
Can a hardware wallet protect me?
A hardware wallet keeps private keys off your computer, which greatly reduces risk. It does not help if your seed phrase is stored digitally on an infected machine.
Where do I report a fake crypto recruiter in the US?
You can file a report with the FBI's Internet Crime Complaint Center at ic3.gov and report the profile to the job platform where the contact happened.
Related Terms
Seed Phrase: A list of words that can restore a crypto wallet and give full control of its funds to anyone who has it.
Private Key: A secret number that authorizes transactions from a crypto address.
Hot Wallet: A crypto wallet connected to the internet, such as a browser extension or mobile app.
Hardware Wallet: A physical device that stores private keys offline and signs transactions without exposing the keys.
Social Engineering: Manipulating people into giving up information or taking unsafe actions, rather than hacking systems directly.
Sources
National Police Agency of Japan, FBI, and partners. "North Korean WaterPlum, commonly referred to as Contagious Interview, Cyber Actor Group Targeting IT Professionals." Joint advisory, September 18, 2026. https://www.npa.go.jp/bureau/cyber/pdf/20260918_e.pdf
Palo Alto Networks Unit 42. "Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware." October 2024. https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/
Datadog Security Labs. "Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview." October 2024. https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/
FBI Internet Crime Complaint Center. "North Korean IT Workers Conducting Data Extortion." Public service announcement, January 23, 2025. https://www.ic3.gov/PSA/2025/PSA250123
Forbes. "North Korea Shock: Fake Job Interviews Drain $10.7M From 7,000 Wallets." September 19, 2026. https://www.forbes.com/sites/boazsobrado/2026/09/19/north-korea-shock-fake-job-interviews-drain-107m-from-7000-wallets/
