North Korean Hackers Drain 7,000 Crypto Wallets with Fake Job Offers

A North Korean threat group known as 'WaterPlum' has been linked to over 7,000 drained crypto wallets across more than 100 countries. The group uses fake job offers and coding tests to infect machines with malware, resulting in losses estimated at 1.7 billion Japanese yen (10.71 million USD) or approximately 130 Bitcoin.

The joint advisory from seven agencies, including Japan's National Police Agency and the FBI, warns that the attackers pose as recruiters for companies working in AI, cryptocurrencies, and NFTs. They approach developers through social networks, job boards, and freelancer platforms, eventually asking them to download and execute files hosted on developer platforms.

The malware, which includes families such as BeaverTail, InvisibleFerret, and OtterCookie, can be spread even if the victim doesn't deliberately run a program. It can also disguise itself as a project folder with a blockchain theme, further increasing its chances of going undetected.