A developer gets a LinkedIn message from a recruiter at what looks like a legitimate AI startup. The coding test arrives via GitHub, they clone the repo, run the project, and within minutes a keylogger is quietly cataloguing every keystroke, including the passphrase to their crypto wallet.
That scenario is exactly what a joint advisory confirmed on September 18, 2026: a North Korea-linked group called WaterPlum compromised more than 30,000 devices across over 100 countries and stole approximately $10.71 million in cryptocurrency. The advisory was issued by Japan’s National Police Agency, the FBI, Australia’s ASD Cyber Security Centre, and Germany’s BND and BfV, targeting the people most likely to trust a code repository from a stranger.
How the Attack Works
WaterPlum actors pose as recruiters on job platforms and social media, then weaponize the coding test itself.
The group contacts software engineers, web designers, and Web3 professionals with remote job offers for AI, crypto, and NFT companies. Once a target is engaged, they receive a “technical assignment” or a file to fix a supposed video call issue, hosted on Git repositories or distributed as NPM packages.
Running the project deploys malware families including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle. These tools silently exfiltrate credentials, clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents, and the access persists long after the interview ends.
The Broader Operation
Seven agencies across four countries confirmed the scale, and the financial theft is only part of the damage.
Between roughly December 2025 and July 2026, WaterPlum drained or captured credentials from more than 7,000 cryptocurrency wallets. That total transferred 1.7 billion yen, approximately $10.71 million, directly to North Korea.
The 30,000 infected devices span more than 100 countries, making this a global operation rather than a targeted regional attack. The campaign connects to a wider North Korean IT worker ecosystem. Researchers estimate roughly 100,000 workers operate globally under false identities, potentially generating over $500 million annually for the regime.
Stolen credentials and identity documents serve a longer strategic purpose, one built to evade international sanctions.
Red Flags and What to Do
The warning signs exist at both ends of the interview, for candidates and hiring managers alike.
Hiring managers should treat several behaviors as hard stops: candidates who refuse on-camera verification, show visual glitches consistent with AI face-swapping tools, fail to perform at the level their resume suggests, or insist on being paid exclusively in cryptocurrency. These are not quirks of a nervous applicant.
For developers and crypto users, the Gblock security briefing summarizing the advisory states it plainly: “Never execute third party code on a machine that touches your wallets or personal data.” Open unknown VS Code projects in Restricted Mode and reject trust prompts for unfamiliar directories.
Run any recruiter-sent code in a sandboxed environment or virtual machine, on a device with no connection to wallet keys or sensitive accounts. If compromise is already suspected, the advisory recommends treating it as confirmed: assume passwords, credentials, and sensitive files are exposed, then initiate a full forensic investigation and coordinate with national cybersecurity authorities.
Remote hiring norms built around trust in shared code repositories are now a documented attack surface. The advisory signals that developer tools, hiring platforms, and identity verification practices will all need to adapt.
