On September 18, 2026, seven agencies across four countries put an official name on a hacking operation researchers have quietly tracked since 2023. Japan's National Police Agency and National Cybersecurity Office, the FBI, the US Department of Defense Cyber Crime Center, Australia's Cyber Security Centre and Germany's BND and BfV jointly attributed the "Contagious Interview" fake-job campaign to a North Korean state group they call WaterPlum. The headline numbers: more than 30,000 infected computers across over 100 countries, roughly 7,000 compromised crypto wallets, and about 1.7 billion yen, close to $10.71 million, stolen. Peak activity ran from December 2025 through July 2026.

Security vendors have described pieces of this campaign for years. What changed is the source: not a vendor selling a subscription, but four governments putting their names on a headcount.

RelatedCrypto Hacks Hit $1.32B in H1 2026, CertiK Warns

How does a job offer turn into a backdoor?

The mechanics are almost boring in how well they work. An operator poses as a recruiter, headhunter or venture capitalist scouting for an AI, crypto, Web3 or NFT startup, reaches out to a developer or IT professional on social media or a job board, and sends a "technical assessment": a coding challenge delivered as a GitHub or Bitbucket repository. The candidate clones it, runs the setup instructions like any other take-home test, and an npm postinstall script quietly executes obfuscated JavaScript in the background.

The Contagious Interview attack chainFlow diagram showing a fake recruiter DM leading to a take-home test repository, then a malicious npm postinstall script, then the BeaverTail infostealer, then the InvisibleFerret backdoor. FIG. 1 / ATTACK CHAIN Fake recruiter DM on job board "Technical assessment" GitHub / Bitbucket repo npm postinstall obfuscated JS runs BeaverTail infostealer browser, wallet, keystroke data InvisibleFerret backdoor Python, remote access persists genztech.blog
Fig 1 The DM leads to a repo, the repo leads to a postinstall script, and the script drops two payloads: one that steals what's already on the machine, one that keeps a door open for later.

That two-stage payload is the part most coverage skims past. BeaverTail runs first and grabs what's already on the machine: saved browser credentials, clipboard contents, crypto wallet files, keystrokes, screenshots and identity documents. InvisibleFerret follows and sets up a persistent Python backdoor, so the operator does not need to repeat the social-engineering step to get back in. The advisory also names three newer variants: OtterCookie, a JavaScript remote-access tool; OtterCandy, a hybrid of the two approaches; and StoatWaffle, a Node.js loader that fetches the rest of the toolkit. None of this requires a zero-day. It requires a developer trusting a coding assignment enough to run "npm install."

Why does the math point to volume, not whales?

Divide $10.71 million by 7,000 wallets and the average haul is about $1,530 per victim. That is not a number that funds a lifestyle on its own. It only adds up at scale, which is why the 30,000-device count matters more than the dollar figure. This was never built to land one enormous score against a crypto exchange. It was built to run thousands of small, repeatable extractions against ordinary developers, the kind who keep a wallet with a few thousand dollars in it and a laptop full of source code and saved logins.

WaterPlum campaign scale, devices versus walletsBar chart comparing 30,000 infected devices to 7,000 compromised crypto wallets, with 100 or more countries and 10.71 million dollars stolen noted as context stats. FIG. 2 / CAMPAIGN SCALE 100+ countries hit $10.71M stolen total 30,000 devices infected 7,000 wallets compromised genztech.blog
Fig 2 Devices infected outnumber wallets hit by more than four to one. Not every infection reaches a wallet, but every infection hands over a machine.

That framing also explains why the advisory leans on the infection count instead of the theft total. $10.71 million barely registers against a single well-executed exchange hack. Thirty thousand compromised machines across a hundred countries is a supply-chain problem, because many of those machines belong to people who had legitimate access to source repositories, internal tools and client credentials before they got infected.

Who is actually running WaterPlum?

The advisory places WaterPlum under the 313 General Bureau, a unit of North Korea's Munitions Industry Department, which also oversees weapons production. Investigators assess that some North Korean IT workers operating abroad under fake identities answer to the same bureau, framing both schemes as parallel revenue streams rather than separate operations. The trick behind both is the "laptop farm": a facilitator hosts company laptops in a home or small office so operators positioned in North Korea, China, Russia, Africa and Southeast Asia can appear to be logging in locally, using stolen identities and VPNs to pass basic employment checks. Japanese police dismantled one such farm this year and traced several hundred million yen that had already moved overseas.

RelatedBrevo Breach Exposes 347K Trezor Users to Phishing Scam

WaterPlum / Contagious InterviewDPRK IT-worker schemeBig-exchange heists
TargetIndividual developers and IT professionalsEmployers hiring remote engineering talentCentralized exchanges and custodians
Per-victim takeSmall, a few thousand dollars typicallyA recurring salary, paid over monthsVery large, a single concentrated payout
Entry vectorFake job offer, malicious take-home repoForged resume, stolen identity, real hiring pipelineInsider access, key compromise, protocol exploit
Detection difficultyHard, looks like routine developer toolingHard, looks like a normal remote employeeEasier after the fact, transaction is highly visible
  1. Nov 2023Unit 42 first names Contagious Interview Palo Alto Networks researchers document the fake-recruiter pattern
  2. Dec 2025Peak activity begins Infection rate and wallet theft accelerate
  3. Jul 2026Peak activity window closes Case volume feeding the advisory largely collected by this point
  4. Sep 18 2026Joint advisory names WaterPlum Seven agencies across Japan, the US, Australia and Germany issue formal attribution

What should developers do today?

The advisory's mitigation list is aimed squarely at the people most likely to be targeted next: anyone job-hunting in AI, crypto, Web3 or NFT roles, and anyone maintaining an npm-dependent codebase.

  • Run take-home assignments in an isolated virtual machine, never on your primary laptop, and never with your real wallet or password manager logged in.
  • Read the setup script before you run it. Watch for curl piped into a shell, base64-encoded strings, PowerShell's -enc flag, and mshta.
  • Check VS Code's Restricted Mode and open .vscode/tasks.json before trusting a cloned workspace; task runners are a common place to hide an auto-run command.
  • If something felt off, assume every credential on that machine is burned. Rotate passwords, move wallets to a clean device, and reinstall the OS rather than cleaning in place.
  • Employers should verify applicant IP addresses and treat refusal to do a live video interview as a real red flag.

Related reading: our earlier report on Lazarus exploiting a Windows AFD.sys zero-day covers a different North Korean unit going after a kernel flaw instead of a developer's trust. Different tools, same government payroll.

Our take

The headcount is the real story, not the dollar figure. Ten million dollars is a rounding error next to what a single exchange breach can produce, but 30,000 infected developer machines is a foothold into thousands of separate codebases and credential stores. That is quieter damage than a headline crypto heist, and harder to clean up, because you cannot always tell what a stolen set of API keys or a leaked private repo eventually gets used for. The four-country joint attribution matters too. Vendor reports get discounted as marketing; a signed advisory from the FBI, Japan's NPA, Australia's ACSC and Germany's BND does not have that problem, and it pressures GitHub, Bitbucket and npm to treat this pattern as known and named rather than a one-off.

What to watch · 2026-2027
  • More named variants. OtterCookie, OtterCandy and StoatWaffle suggest an active pipeline, not a pause.
  • Registry-level response. Whether npm, GitHub or Bitbucket ship stronger postinstall warnings after being named as the delivery path.
  • Other governments joining in. South Korea and the EU have not signed this advisory yet.
  • Overlap with the IT-worker scheme. Watch for joint prosecutions treating both as one enforcement target.
Primary sources

Original analysis by GenZTech. Source: The Japan Times.