North Korean hackers used fake job offers to infect 30,000 computers and steal crypto

A job offer is now one of the most reliable ways to lose a crypto wallet. On 18 September 2026, seven agencies across four countries put their names to a single document describing how: Japan’s National Police Agency and National Cybersecurity Office, the US Federal Bureau of Investigation and the Department of Defense Cyber Crime Center, the Australian Signals Directorate’s Australian Cyber Security Centre, and Germany’s Federal Intelligence Service and Federal Office for the Protection of the Constitution.

The group they name is WaterPlum, which the advisory says is commonly referred to as Contagious Interview. The NPA and the FBI assess that WaterPlum and some North Korean IT workers both operate under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers’ Party of Korea.

The interview is the attack

WaterPlum operators approach developers through social media, job boards, gig platforms and freelance marketplaces, posing as employers. The advisory says they often impersonate real artificial intelligence, cryptocurrency and NFT companies, and have used recruiting services to reach people.

The pitch arrives as a technical screening. A candidate is asked to sit a coding assignment or to debug a problem in the video conferencing tool, and in the process to download and run a file hosted on a developer platform. The advisory reproduces the line the operators use: “I would like to verify your technical abilities, so please download the specified file and complete the assigned task.”

Five malware families, all arriving as an npm package

The delivery mechanism is consistent. Operators upload Node Package Manager packages carrying one of five families, and the advisory describes each one:

• BeaverTail, JavaScript malware hidden inside npm packages, downloadable from GitHub or Bitbucket.
• InvisibleFerret, a Python backdoor into the victim’s network.
• OtterCookie, a JavaScript remote access trojan that also steals information.
• OtterCandy, which combines OtterCookie with RATatouille.
• StoatWaffle, a modular Node.js family bundling a loader, credential harvesting and a remote access trojan.

StoatWaffle is the one worth reading twice. It arrives as a Microsoft Visual Studio Code project, using blockchain-themed repositories as decoys, and embeds a malicious VS Code configuration file that triggers auto-run code execution the moment the folder is opened and trusted. Nothing needs to be compiled and no script needs to be launched by hand. Opening the project is the execution step.

Once a loader lands, the operators keep remote access trojans in place for persistence and for moving across systems, and run infostealers that send data out to a command-and-control address.

What they take off the machine

The advisory lists the targets for exfiltration: authentication data stored in web browsers, clipboard contents, recorded keystrokes and screenshots, cryptocurrency wallet data including private keys and seed phrases, and any file of interest sitting on the PC or in a shared folder. That last category explicitly includes photographs of driving licences and passports.

Those identity documents are not a side catch. Stolen ID images are passed to North Korean IT workers who use them to impersonate the victim and win contract work. A compromised developer can therefore fund the same operation twice: once through the wallet, and again through a face on a forged résumé.

The advisory counts 30,000 infected PCs

Between around December 2025 and July 2026, WaterPlum exploited at least 30,000 PCs across more than 100 countries, Japan and the United States among them. The primary targets were individual web designers, engineers and specialists in cryptocurrency, blockchain and Web3. The operators took funds or account credentials from over 7,000 cryptocurrency wallets and moved at least ¥1.7 billion, about $10.71 million, to the Democratic People’s Republic of Korea.

Japan took apart its first laptop farm

The second half of the advisory covers a related trade: North Korean IT workers who hold genuine contracts under someone else’s identity. A laptop farm is the physical part of that arrangement, usually an enabler’s home, where work computers are set up and then driven remotely from abroad. The workers themselves sit in North Korea, China or Russia, with a smaller number in Africa and South East Asia.

For the first time in Japan, authorities identified, investigated and dismantled a laptop farm run by an enabler in the country. Investigators obtained evidence that several hundred million yen in cryptocurrency had been transferred out of Japan. The advisory is direct about where the liability sits for anyone hosting one: paying North Korean IT workers, or facilitating their revenue generation, may breach domestic law and sanctions.

It also records two cases where the work turned destructive. One IT worker extorted a company over payment and published its proprietary source code. Another, hired for website maintenance, defaced the client’s site and left it inaccessible.

A crypto exchange caught one at interview

In May 2025 a Japanese cryptocurrency exchange received an application for an engineering role, submitted through its own recruitment form over a VPN. The CV claimed more than ten items of knowledge and experience across each of programming languages, blockchain and cryptocurrency technologies, and cloud services, plus a European university education followed by a rapid run of jobs across European and Asian cities.

On the video call the applicant said he was born in Malaysia, lived in Finland, and spoke Malay and Chinese natively. The interview ran in English, and his English did not match the academic and professional history on the CV. He answered simple questions and could not speak to most of the skills he had listed. The company found the combination suspicious, declined to hire, and took no damage.

Interviewers at other companies reported a recognisable set of behaviours: excuses about meeting in person, requests to be paid in cryptocurrency, frequent glances at a second monitor as though reading, occasional background voices, and repeated video or audio freezes.

The habits that gave them away

Investigators also logged how the operators worked. Some ran online interviews through AI face-swapping software, then turned their video off after a few minutes and advised the target to do the same, citing network trouble. They practised Japanese pronunciation with text-to-speech tools and stayed on free machine translation and AI plans throughout. On North Korean public holidays they played games and watched football videos instead of running operations.

What to do if you ran one of those files

The agencies’ advice for an individual developer is specific. Treat any code from a third party as untrusted, and run unknown code only inside a sandbox or virtual machine after checking it for obfuscated sections. Be wary of commands containing the seven strings the agencies single out: curl, base64, -enc, mshta, Invoke-WebRequest -uri, iwr-uri and hidden. If anything is detected, disconnect the machine from the internet immediately.

Then assume the wallet is gone before it is gone. Create a new wallet on a separate device, move every asset across, and keep the new seed phrase offline. Back up what you need and fully reset the operating system, because removal tools do not prove the machine is clean.

For VS Code specifically: open unknown projects in Restricted Mode by answering “No” to the prompt asking whether you trust the authors, which stops .vscode/tasks.json running on launch. Read that file before trusting the folder, and take care with projects opened from a path already marked as trusted. Companies are told to deploy endpoint detection and response tooling, and to hold source code and credentials to the minimum access anyone needs.

The two operations share an address book

The detail that ties the document together sits near the end. WaterPlum operators and North Korean IT workers used the same IP addresses when accessing laptop farms, when working through crowdsourcing services, and when applying for that job at the Japanese exchange.

So the recruiter sending a developer a coding task and the candidate applying to a crypto firm are drawn from one pool, working the same hiring pipeline from both ends. The agencies record that the techniques were established by Japan’s Kanto Regional Police Bureau cyber unit, prefectural police and the FBI, working with private sector partners, and they thank NTT Security in Japan and bitFlyer for their cooperation in preparing the advisory.

The picture follows the same direction of travel as the DPRK’s move to hide malware inside smart contracts: the tooling is ordinary developer infrastructure, and the entry point is a person who thinks they are being interviewed.