WaterPlum Hackers Infect 30,000 Devices, Steal $10.7M in Cryptocurrency

A North Korean hacking group called WaterPlum has compromised at least 30,000 devices worldwide between December 2025 and July 2026, according to a joint advisory from Japanese, US, Australian, and German authorities.

The group transferred more than $10.7 million in stolen cryptocurrency to North Korea during this period.

WaterPlum is linked to a multi-year campaign called 'Contagious Interview,' which targets job seekers with malicious npm packages that infect their devices with malware.

The attackers impersonate legitimate AI, cryptocurrency, and NFT companies or use recruiting and freelance platforms to approach job seekers.