WaterPlum Fake job recruitment attacks affect more than 30000 devices; at least 10710000 USD flowed into attacker wallets
BIBIBI
AT A GLANCE
Agencies in multiple countries warn that the North Korea-linked hacking group WaterPlum uses fake recruitment to target IT developers, stealing at least 10710000 USD。
Article
【North Korean hacker group WaterPlum uses fake job offers to steal 10710000 USD】
A joint warning from agencies in multiple countries, including the U.S. Federal Bureau of Investigation and Japan’s National Police Agency, indicates that the North Korea-linked hacker group WaterPlum, also known as Contagious Interview, from 2025 year December to 2026 year July posed as companies in AI, cryptocurrency, or NFT sectors to offer fake job positions, targeting IT developers worldwide. Attackers contact job seekers through social media and recruitment platforms, luring them to download malicious files under the pretext of technical interviews or programming tests. The infections have affected more than 100 devices across multiple countries and regions, and data has been stolen from more than 30000 crypto wallets; at least 7000 in funds flowed into wallets controlled by the attackers.
🎾🎾🎾🎾🎾🎾🎾🎾
Breaking news/advertising contact 10710000 USD Funds flowed into wallets controlled by the attackers.
A joint warning from agencies in multiple countries, including the U.S. Federal Bureau of Investigation and Japan’s National Police Agency, states that the North Korea-linked hacker group WaterPlum, also known as Contagious Interview, from 2025 year December to 2026 year July posed as companies in AI, cryptocurrency, or NFT sectors to offer fake job positions, targeting IT developers worldwide.
02
Attackers contacted job seekers through social media and recruitment platforms.
03
Attackers induced job seekers to download malicious files under the pretext of technical interviews or programming tests.
04
Has infected and covered 100 countries and regions, with more than 30000 devices.
05
Stole data from more than 7000 cryptocurrency wallets.
06
At least 10710000 USD in funds flowed into wallets controlled by the attackers.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This report states that the U.S. Federal Bureau of Investigation, Japan’s National Police Agency, and other agencies in multiple countries jointly issued a warning: the hacker group alleged to be linked to North Korea WaterPlum(also known as Contagious Interview) reportedly 2025 through December to 2026 during July posed as companies hiring in AI, cryptocurrency, or NFT sectors, targeting IT developers worldwide. They contacted job seekers through social media and recruitment platforms, using technical interviews or coding tests as a pretext to induce them to download malicious files. The report states that more than 30000 devices were affected across 100 countries and regions, with data from more than 7000 cryptocurrency wallets, and at least 10710000 USD flowed into wallets controlled by the attackers.
Why it matters to readers
For developers, the recruitment process itself can become an entry point for attacks, and additional vigilance is needed during steps involving file downloads, coding tests, and similar activities; the message also links the scale of the losses to cryptocurrency wallets and the flow of funds, indicating that such attacks may cause direct financial losses.
If you are looking for a job, especially if you receive invitations to interviews and coding tests from AI, cryptocurrency, or NFT companies in the sector, be cautious if they ask you to download or run files; this message is a reminder that the job-search process may also be used to deliver malicious files.
Risks and unknowns
Related Developments
Loading event timeline…
The evidence provides only a single source (a forwarded Telegram channel post), without the original joint alert document or link.
The numbers of devices, countries, wallets, and 10710000 USD mentioned in the article are relayed from the message; no statistical methodology or verification method was provided.
The specific distribution of victims, organization names, and subsequent handling of the incident were not specified.
Promotional information containing contact details appears at the end of the text and is unrelated to the security alert content.
Related concepts
WaterPlum
This term is not in the glossary yet. Browse related concepts in the glossary.
