North Korean Hackers Scam Thousands of IT Job Seekers Worldwide

A North Korean hacking group called WaterPlum has been scamming IT job seekers worldwide, stealing roughly Rs 100 crore in cryptocurrency. The group posed as recruiters to target software developers, web freelancers, and other IT professionals, offering job opportunities and tricking them into downloading malicious files.

The campaign ran from December 2025 to July 2026, during which the hackers obtained funds or account details from over 7,000 cryptocurrency wallets and transferred approximately Rs 100 crore to North Korea. The group has been active since 2023 and has carried out both financially motivated attacks and cyberespionage.

Authorities warned that the damage was not limited to individual victims, as infected devices could be used as a path into an employer's network, exposing source code, credentials, trade secrets, and other sensitive material.