North Korean fake recruiter infects 30,000 devices and steals $10.7 million

According to a joint announcement issued by the relevant departments of four countries, Japan , Germany , Australia and United States , North Korea's hacker organization WaterPlum has illegally stolen at least US$10.7 million from jobseekers through posing as recruiters for legitimate cryptocurrency and artificial intelligence companies. The group is also known as "Contagious Interview" and targets mainly developers and IT professionals around the world.

Fake recruitment trap is real: malicious files hidden in the test bin programming

According to the announcement, WaterPlum's members are impersonating recruiters from regular companies in artificial intelligence , cryptocurrency or NFT and using various types of recruiting services. The agency said that it is mainly aimed at web designers, engineers and professionals in technical fields such as cryptocurrency , blockchain and Web3 .

The group reaches out to job seekers through social media , an online recruitment platform, a part-time platform or the freelance marketplace. In the bribery recruiting process stack, victims are asked to download and run malicious files disguised as programming test questions or video conferencing troubleshooting tools.

Once an attacker has gained backdoor access to a victim's computer, it deploys remote access Trojans and information theft classes malware and crypto asset to steal sensitive data.

Incredible scale: 30,000 devices in more than 100 countries

The announcement revealed that between December 2025 and July 2026, WaterPlum infected at least 30,000 devices in more than 100 countries around the world, transferring funds or account credentials from over 7,000 crypto wallet s.

According to the announcement, stolen identity documents allow North Korean IT personnel to impersonate victims for income and sensitive information can be used for blackmail.

Related to North Korea's plan to recruit foreign IT personnel

The announcement links WaterPlum to North Korea's overall operations of placing IT personnel inside foreign enterprises. Japan and United States Relevant Sector Evaluation considers that members of WaterPrum, along with some North Korean IT workers, operate under the control of the DPRK Ministry of Military-Industrial Affairs.

The announcement mentions one case: a suspected North Korean IT employee applied for an Japan engineer position with a fake resume, and the exchange rejected his application after discovering that he was unable to explain in detail the skills listed on his résumé during an interview due to apparent inconsistencies. Another more recent example occurred this July when Consensys reportedly hired a developer associated with North Korea as a consultant without knowing it.

Despite warnings and enforcement efforts over the years, North Korea has continued to steal funds from cryptocurrency , with this exposure being just the latest example. The Federal Bureau of Investigation (FBI) had previously identified North Korea as responsible for a $1.5 billion theft at exchange Bybit in February 2025, while relevant agencies issued warnings about its undercover IT personnel back in 2018.