Fake job interviews infected 30,000 devices, agencies say

A joint advisory published on 18 September describes WaterPlum, also known as Contagious Interview, posing as recruiters or technology companies to reach software developers. During video interviews and coding tests, targets were asked to download or run files hosted in developer platforms and code repositories. The agencies say malicious npm packages and project files could install malware that steals credentials, personal data and cryptocurrency wallet information.

The advisory is based on information from law-enforcement and security partners in Japan, the United States, Australia and Germany. The FBI and Japan’s National Police Agency assess WaterPlum and some North Korean IT workers as operating under a DPRK bureau; this is attributed agency assessment, not independent attribution by Capvise.

For activity from December 2025 through July 2026, the advisory reports at least 30,000 infected devices in more than 100 countries. It says funds or credentials were taken from more than 7,000 cryptocurrency wallets and at least 1.7 billion yen—about $10.71 million—was transferred in cryptocurrency to North Korea. These figures describe the advisory’s reported campaign; they are not a count of confirmed corporate breaches.

The alert urges developers to avoid running unfamiliar assessment code on machines with sensitive data or crypto assets, and recommends using an isolated sandbox or virtual machine. A plausible job listing or repository is not proof that a task is malicious, but the agencies’ warning makes the execution environment a concrete part of the risk.