The job offer looks real. The company has a website, the recruiter is friendly, and the technical interview comes with a small coding task: download this project, run it, fix the bug. On at least 30,000 computers in more than 100 countries, that was the moment a North Korean hacking group got in.
The figure comes from a joint advisory published on Friday by police and intelligence agencies in Japan, the United States, Australia and Germany. It describes a group the agencies call WaterPlum, better known among researchers as Contagious Interview, and it puts numbers on a campaign that until now has mostly been described one case at a time.
What the agencies counted
Japan's National Police Agency measured the activity from roughly December 2025 to July 2026. Over those months, the advisory says, the group emptied or took the login details of more than 7,000 cryptocurrency wallets and sent at least 1.7 billion yen, about $10.71 million, in cryptocurrency to North Korea.
The victims are mostly individuals. They are web designers, engineers and people who build blockchain software, many of them freelancers looking for the next contract. The advisory names Japan, the United States and Europe as the places where most of them were found.
How the interview goes wrong
The group poses as an employer, often borrowing the identity of a genuine company in artificial intelligence, cryptocurrency or NFTs, and finds candidates through social media, job boards and freelance marketplaces. Somewhere in the hiring process the candidate is asked to run something. It may be a coding assignment hosted on a popular code sharing service, or a supposed fix for a video call that will not connect.
The project pulls in npm packages that carry malware. The advisory names five families: BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle. The last of these does not even need the victim to launch anything by hand. It hides in a Visual Studio Code project, inside a configuration file that executes as soon as the developer opens the folder and marks it as trusted.
From then on the attackers have remote control of the machine and software that harvests whatever is valuable: passwords saved in browsers, clipboard contents, keystrokes, screenshots, wallet keys and seed phrases, and files such as photos of passports and driver's licenses. A developer's laptop can also be a way into the systems of whoever employs them.
Hackers who also take contract work
The more unusual part of the advisory is the connection it draws to another North Korean operation, the remote IT workers who take contract jobs abroad under false identities. The agencies say some WaterPlum members also do web development for paying clients, and that both sets of people were seen connecting from the same IP addresses. Identity documents stolen from infected developers can be reused by those workers to apply for jobs in a victim's name.
The FBI and the Japanese police assess that the hackers and some of the IT workers report to a body known as the 313 General Bureau, which belongs to the department that runs North Korea's munitions industry. Japan also reported a first. Its police found and dismantled a so called laptop farm on Japanese soil, a home where company laptops are kept switched on so that workers abroad can operate them remotely and appear to be local.
Investigators got a look at the people behind the keyboards as well. They used face swapping software in video interviews, then turned the camera off after a few minutes and blamed the connection. They rehearsed spoken Japanese with software that reads text aloud. On North Korean public holidays, the advisory notes, they played games and watched soccer instead of working.
Advice for developers
The guidance is aimed first at the person on the receiving end of the interview:
- Do not run a stranger's code on a machine that holds wallets or personal data. Use a virtual machine or a sandbox, and read the code first.
- Open unfamiliar Visual Studio Code projects in Restricted Mode, and inspect the
.vscode/tasks.jsonfile for anything that downloads or runs other files. - Be suspicious of commands containing
curl,base64ormshtaunless it is clear what they do. - After an infection, assume the wallet data is already gone. Create a new wallet on a different device, move the funds and wipe the infected machine completely.
Companies that hire remote contractors are told to check that an applicant's phone number works and that their IP address fits where they claim to live, to ask detailed questions about the skills on a resume, and to be wary of anyone who wants to be paid in cryptocurrency or into another person's account.
