WaterPlum Targets Developers With Fake Jobs and Malicious npm Packages
A joint government advisory published September 18, 2026 says the North Korea-linked WaterPlum group, commonly tracked as Contagious Interview, has compromised at least 30,000 devices in more than 100 countries while targeting software developers, web freelancers and other IT professionals through fake recruitment campaigns.
The advisory, issued by agencies from Japan, the United States, Australia and Germany, says WaterPlum actors pose as employers — often in AI, cryptocurrency and NFT businesses — and direct candidates to run malicious files during technical interviews, coding assignments or purported videoconferencing troubleshooting. The documented delivery methods include malicious npm packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle malware or related variants.
The agencies report that WaterPlum transferred funds or account credentials from more than 7,000 cryptocurrency wallets and moved at least 1.7 billion Japanese yen (about $10.71 million) in cryptocurrency assets to the Democratic People's Republic of Korea. Japan's National Police Agency and the FBI assess that WaterPlum actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department.
How the fake-recruitment infection path works
The advisory describes a recruitment workflow aimed directly at technical workers. Actors contact job seekers through social networks, job sites, gig platforms and freelance marketplaces, then require an online technical interview or coding exercise. Targets can be instructed to download code from collaboration platforms or repositories, execute a coding assignment, or run a supposed fix for a video-conferencing problem.
Malicious npm packages are one documented delivery mechanism. The advisory describes BeaverTail as JavaScript malware hidden in npm packages and InvisibleFerret as a Python backdoor. OtterCookie combines remote-access and information-stealing capabilities, while OtterCandy combines features associated with OtterCookie and RATatouille. StoatWaffle is described as a modular Node.js family with loader, credential-harvesting and remote-access components; observed campaigns also used malicious Visual Studio Code project configuration to trigger code execution after a project was opened and trusted.
After initial access, the actors use remote-access tools and information stealers to maintain connectivity and collect sensitive data. The advisory lists browser authentication data, clipboard contents, keystrokes, screenshots, cryptocurrency wallet keys or seed phrases, identity documents and other files among the targeted information.
Developer controls recommended by the advisory
The joint guidance recommends running unknown code only inside a sandbox or virtual machine, particularly when the workstation also handles cryptocurrency assets or personal data. Developers should inspect unfamiliar code for obfuscated or unreadable sections before execution and treat unsolicited scripts or commands that download or execute additional content as a security-review event.
Visual Studio Code users have an additional control for unfamiliar projects: open them in Restricted Mode and inspect .vscode/tasks.json before granting workspace trust. This matters because the advisory documents StoatWaffle activity in which a malicious VS Code configuration can execute code when a project folder is opened and trusted.
Organizations should also limit source-code, credential and system access to the minimum required for contractors and new hires. Endpoint detection and response monitoring is among the controls recommended for companies. If a device is suspected of compromise, the advisory recommends disconnecting it from the internet, treating sensitive data as potentially exfiltrated, and rebuilding the affected operating system after preserving essential data needed for response.
A separate risk: North Korean IT-worker laptop farms
The same advisory covers a second, related operation involving North Korean IT workers obtaining legitimate remote-development contracts while concealing their physical location. It describes laptop farms — computers hosted by facilitators and remotely controlled by workers elsewhere — along with VPS infrastructure used to obscure where work is performed.
Japanese authorities report dismantling a laptop farm in Japan for the first time. The FBI separately continues investigations and prosecutions involving US-based facilitators. The advisory says laptop farms and recruiter-malware operations have shared infrastructure indicators, including IP addresses, while presenting different risks to employers and developers.
For hiring teams, the joint guidance recommends validating applicant identity and technical claims, checking whether network location broadly matches the claimed residence, verifying certifications when appropriate, and limiting access until identity and role requirements are established. It also identifies requests for cryptocurrency payment and payment to accounts in another person's name as observed signals in North Korean IT-worker cases.
Scale and attribution
The 30,000-device, 100-plus-country, 7,000-wallet and 1.7-billion-yen figures are assessments published by the participating agencies. The advisory says the observed device compromises span roughly December 2025 through July 2026 and primarily affected web designers, engineers and cryptocurrency, blockchain and Web3 specialists.
The attribution is a coordinated government assessment backed by investigative and private-sector information. The technical takeaway for developers is concrete: recruitment exercises and unfamiliar project repositories now belong in the same untrusted-code workflow as any other third-party software artifact.
Bottom line
WaterPlum's recruitment campaigns turn ordinary developer workflows — coding tests, npm dependencies, repositories and VS Code projects — into initial-access paths. Developers can reduce exposure by isolating take-home assignments and unfamiliar repositories, reviewing package and project configuration before execution, and withholding workspace trust until the source has been verified. Hiring organizations need a parallel identity-verification and least-privilege process for remote technical workers.