North Korean Phishing Crew Hits 30K Devices, Steals $10.7M Crypto

North Korea-linked hacking group WaterPlum—also tracked as “Contagious Interview”—has stolen at least $10.7 million by tricking job seekers into installing malware under the guise of recruitment for legitimate crypto and AI companies, according to a joint cyber advisory issued by authorities in Japan, Germany, Australia, and the United States.

The campaign, which has targeted software developers and IT professionals across multiple countries, combines fake hiring workflows with malicious files that grant attackers remote access to victims’ systems, enabling the theft of cryptocurrency and other sensitive information.

Key takeaways

• WaterPlum used fake recruiter identities and recruitment services to impersonate real crypto, blockchain, AI, and Web3 companies.
• Victims were commonly directed to download and run malware disguised as coding tasks or fixes for video-conferencing problems.
• Authorities link the group to a broader North Korean strategy of placing IT workers inside foreign organizations.
• Reported impact includes at least 30,000 infected devices in more than 100 countries and theft from over 7,000 crypto wallets between December 2025 and July 2026.
• Beyond financial theft, stolen documents and personal data can be leveraged for impersonation, extortion, or follow-on access to employers.

Fake recruitment as the entry point

In the advisory, the involved authorities describe WaterPlum’s targeting of web designers, engineers, and specialists working in cryptocurrency, blockchain, and Web3-related technologies.

According to the report, attackers reached out through social media, online job platforms, gig work services, and freelance marketplaces. Once a candidate engaged, the impostors allegedly instructed the victim to download and execute malicious files, framing them as either coding assignments or troubleshooting steps for video-conferencing errors.

While recruitment scams are not new, this campaign’s focus on technical roles and blockchain-specific expertise increases the odds of victims being persuaded by the “work assignment” narrative—especially when malicious files are disguised as development deliverables.

From malware to wallet theft and data exfiltration

The advisory says the scheme went beyond deception and culminated in compromise. After gaining backdoor access to a victim’s computer, WaterPlum operators reportedly used remote-access tools and infostealing malware to exfiltrate sensitive data and cryptocurrency.

The attackers also created a pathway for further infiltration: successful infections can allow WaterPlum to compromise organizations that employ the recruited developers, particularly if the victim is granted access to internal systems, source code, or related accounts.

Authorities estimate that WaterPlum infected at least 30,000 devices across more than 100 countries. During the period from December 2025 through July 2026, the advisory attributes extraction of funds or credentials from over 7,000 cryptocurrency wallets.

For users and employers, the key risk is that credential or wallet compromise may not be confined to a single endpoint. If logins, signing keys, or operational details are harvested, attackers can potentially move from theft to sustained access or further fraud.

Why the threat extends beyond crypto theft

The joint advisory emphasizes that the harm can be broader than stolen cryptocurrency. It warns that identity documents taken from victims can enable North Korean IT workers to impersonate those individuals and generate income, while other harvested information could be used for extortion.

The advisory also links WaterPlum’s activity to North Korea’s longer-running effort of embedding IT workers inside foreign organizations. Japanese and US authorities, according to the report, assess that WaterPlum actors—and some North Korean IT workers—operate under North Korea’s Munitions Industry Department.

In that context, a recruitment-driven malware campaign can serve a dual function: stealing funds in the short term and supporting infiltration or fraud in the longer term—particularly when victims’ identities are compromised.

Real-world cases highlight operational tradecraft

The advisory describes a suspected North Korean IT worker applying for an engineering role at a Japanese crypto exchange using a forged resume. Authorities say the exchange rejected the applicant after discrepancies emerged during the interview, including the candidate’s inability to explain skills listed on the document in detail.

More recently, earlier reporting from Cointelegraph documented an incident involving Consensys, which unknowingly engaged a North Korea-linked developer as a consultant. Cointelegraph reported that Consensys terminated access after discovering the threat, and that an investigation found no theft of assets or data, no deployment of malicious code, and no impact on user safety.

Together, these cases underline a common pattern: recruitment-related infiltration attempts may be caught before they result in damage, but they still create enough risk to require stronger screening, particularly for roles tied to crypto operations and sensitive technical work.

Part of a wider North Korea funding and infiltration playbook

The WaterPlum campaign is presented as another example of North Korea’s persistent use of cryptocurrency-related theft to raise funds, even amid years of warnings and enforcement efforts.

Cointelegraph notes that the FBI previously blamed North Korea for a $1.5 billion Bybit theft reported in February 2025. US authorities, meanwhile, have warned about North Korea’s undercover IT workers since at least 2018, according to the same coverage.

What makes the WaterPlum advisory particularly significant is the blend of financial criminality and human infrastructure infiltration. The malware delivery method—tied to job hunting—shows how attackers attempt to exploit legitimate hiring processes in a sector where technical trust and remote work are common.

Going forward, the most important open question for organizations is how quickly and consistently recruitment-related compromises are detected—especially when malware is introduced through “normal” workflows like coding assignments and conferencing fixes. Readers should watch for additional advisories detailing mitigation steps, and employers should treat suspicious recruitment paths as a cyber incident risk, not just a fraud concern.