North Korean operation WaterPlum infected 30,000+ devices via fake job postings, stole $10.7M in crypto

North Korean cyber group WaterPlum infected at least 30,000 devices across 100+ countries from December 2025 through July 2026, compromising over 7,000 crypto wallets and stealing $10.7 million, according to reporting by The Daily Hodl and a joint advisory issued September 18 by the FBI, Japanese police, Australian cyber officials, and German intelligence. WaterPlum, also known as Contagious Interview and Deceptive Development, has operated globally since 2022. The operation posts fake job openings on social media and recruiting platforms, frequently posing as AI, crypto, or NFT companies. Applicants directed to run coding tests or fix fabricated video-call errors unknowingly execute malware that monitors the machine and harvests passwords and wallet keys, per The Daily Hodl's account of the advisory. The group targeted machines in the United States, Japan, and Europe. Beyond wallet theft, The Daily Hodl reports WaterPlum hides some activity on GitHub and Ethereum. The primary goal stated in the advisory is to plunder cryptocurrencies and gain access to financial accounts using a combination of social engineering and malicious software disguised as legitimate development tools. The Daily Hodl reports the FBI is actively pursuing US helpers who run laptop farms and manage bank accounts for the operation, indicating infrastructure inside the United States that processes and moves stolen funds. The advisory attributes WaterPlum and North Korea's overseas IT workforce to the 313 General Bureau of the Munitions Industry Department. According to The Daily Hodl's reporting, The scale of device infection (30,000+) and wallet compromise (7,000+) distinguishes this operation from smaller targeted campaigns. The attack surface spans any developer or technician using legitimate-looking job postings to screen candidates. The advisory characterizes the operation as a short-term threat to individuals and organizations in Germany and other EU states, though the geographic span of infections (100+ countries) and the continued active pursuit of US-based helpers suggest the operation retains operational capacity.