WaterPlum Fake Recruiters Infect 30,000 Devices and Steal $10.7M in Crypto
The campaign targeted software developers and IT professionals with fraudulent job opportunities, using malware to compromise victims’ devices. The operation infected at least 30,000 devices across more than 100 countries, according to the advisory.
Fake Recruitment Campaign Targets Crypto and AI Workers
WaterPlum, also known as Contagious Interview, has focused on professionals whose work involves software development, cryptocurrency, blockchain and Web3 technologies. Authorities said the group also impersonated companies in the artificial intelligence and non-fungible token sectors and used recruiting services as part of its approach.
The attackers reportedly reached potential victims through social media, online job platforms, gig-work websites and freelance marketplaces. Once contact was established, job seekers were instructed to download files presented as coding assignments or fixes for problems involving video-conferencing software.
Those files could provide the attackers with backdoor access to the victim’s computer. WaterPlum then used remote-access trojans and information-stealing malware to obtain sensitive information, account credentials and cryptocurrency.
More Than 7,000 Crypto Wallets Targeted
The international advisory said WaterPlum compromised at least 30,000 devices in more than 100 countries between December 2025 and July 2026.
During that period, the group obtained funds or account credentials from more than 7,000 cryptocurrency wallets. Authorities said at least 1.7 billion Japanese yen, equivalent to $10.71 million, in cryptocurrency assets was transferred to North Korea.
The campaign also creates a potential pathway into companies. If a compromised developer later gains employment at a technology company, attackers could potentially use previously established access to target the organization.
The advisory said the consequences extend beyond cryptocurrency theft. Stolen identity documents can also be used by North Korean IT workers to impersonate victims and obtain employment, while sensitive information obtained from compromised devices could be used for extortion.
Authorities Link WaterPlum to Broader North Korean Operations
The advisory links WaterPlum to North Korea’s wider efforts to place IT workers inside foreign companies. Japanese and US authorities assess that WaterPlum actors and some North Korean IT workers operate under North Korea’s Munitions Industry Department.
The warning comes as authorities continue to track North Korean cyber operations targeting cryptocurrency and technology professionals. The latest campaign demonstrates how fraudulent recruitment processes can be used not only to steal digital assets but also to obtain access to sensitive systems and information.
The activity documented in the advisory covers the period from December 2025 through July 2026, when the reported infections and cryptocurrency transfers occurred.
writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on HOKANEWS are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
HOKANEWS isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.