WaterPlum Fake-Recruiter Campaign Infected 30,000 Devices, Authorities Say

Australian, U.S., Japanese and German authorities have warned that the North Korean-linked WaterPlum cyber actor group ran a fake-recruiter campaign that infected at least 30,000 devices in more than 100 countries.

The campaign, which authorities say operated from approximately December 2025 through July 2026, targeted IT professionals by posing as recruiters for artificial intelligence, cryptocurrency and NFT companies. WaterPlum is also known as Contagious Interview.

According to the joint advisory, the actors obtained funds or account credentials from more than 7,000 cryptocurrency wallets. They transferred 1.7 billion Japanese yen, stated as equivalent to $10.71 million, in cryptocurrency to North Korea.

Fake recruitment used as an entry point

Authorities said WaterPlum used fraudulent employment opportunities to target professionals. The group’s methods included fake technical interviews, coding assignments and purported fixes for video-conferencing software, which were used to deliver malware.

The advisory identifies the operation as a cyber threat affecting both job seekers and organizations whose staff may be approached through recruitment-themed communications. The reported scale indicates that the activity extended across more than 100 countries.

Reported device and wallet impact

The advisory puts the number of infected devices at at least 30,000. It also says the group obtained either funds or account credentials from more than 7,000 cryptocurrency wallets.

Authorities attributed the transfer of 1.7 billion Japanese yen, or $10.71 million, in cryptocurrency to North Korea. The figure concerns cryptocurrency linked to the campaign and should not be read as a measure of losses across the wider digital-asset sector.

The case adds to the enforcement and security issues facing crypto users and service providers, alongside developments such as UK agencies targeting suspected illegal peer-to-peer crypto trading in London.

Joint warning from international authorities

The Australian Signals Directorate’s Australian Cyber Security Centre published the advisory alongside partner authorities in Australia, the United States, Japan and Germany. The FBI also listed the matter among its 2026 cyber alerts.

The agencies’ account names WaterPlum and Contagious Interview as the same North Korean-linked actor group. Their findings describe a campaign focused on obtaining access through employment-related social engineering before malware deployment and cryptocurrency theft.

The warning arrives as policy work on digital assets continues in the United States, where the Senate CLARITY Act has stalled while the SEC advances crypto rulemaking.

Continue reading: UK agencies targeting suspected illegal peer-to-peer crypto trading in London on BTCNews.

Continue reading: Senate CLARITY Act has stalled while the SEC advances crypto rulemaking on BTCNews.

Sources

• Australian Signals Directorate’s Australian Cyber Security Centre: North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” cyber actor group targeting IT professionals
• Federal Bureau of Investigation: 2026 Cyber Alerts
• The Register: North Korea’s fake job interviews infected 30,000 devices

Our creator. Creates amazing NFT collections! Support the editor - Bitcoin_Man(TON) / Bitcoin Man Stickers(TON) / BM Numbers (TON) / Comics Book (TON) / Bitcoin_Man (ETH)

Pi Network (Guide)is a new digital currency developed by Stanford PhDs with over 55 million participants worldwide. To get your Pi, follow this link https://minepi.com/Tsybko and use my username (Tsybko) as the invite code.

Binance: Use this link to sign up and get $100 free and 10% off your first months Binance Futures fees (Terms and Conditions).

Bitget: Use this link Use the Rewards Center and win up to 5027 USDT!(Review)

Bybit: Use this link (all possible discounts on commissions and bonuses up to $30,030 included) If you register through the application, then at the time of registration simply enter in the reference: WB8XZ4 - (manual)