WaterPlum: North Korea's Fake Job Interviews Infected 30,000 Developer Devices in 100 Countries

WaterPlum's attack chain begins on social media, not on a vulnerable server. Actors create convincing recruiter personas on LinkedIn, Glassdoor, and freelance platforms such as Upwork and Toptal. They impersonate hiring managers at AI startups, NFT companies, and blockchain projects, then contact developers with targeted outreach that references their public GitHub profile, stack, or recent open-source contributions to appear credible.

The recruitment phase follows a scripted pattern. The actor schedules a video interview, discusses compensation and role details to build rapport, then assigns a technical test: cloning a repository or installing an npm package to demonstrate a coding skill. In some recorded cases, WaterPlum actors used AI face-swapping software during the video call's opening minutes before disabling their camera and citing connection issues, leaving the developer interacting with audio only.

The malicious delivery happens through two primary vectors. The first is an npm package published under a convincing package name, configured with a postinstall lifecycle script that executes BeaverTail or OtterCookie on npm install. The second is a Visual Studio Code project configured with a malicious .vscode/tasks.json that auto-runs hidden commands the moment a developer opens and trusts the project folder. StoatWaffle is the malware family specific to the VSCode delivery path.

Once initial access is established, WaterPlum actors use remote-access trojans to maintain connectivity and infostealers to harvest browser credentials, cookies, keystrokes, clipboard content, cryptocurrency wallet private keys, seed phrases, and documents from the victim's local filesystem and any network shares accessible from the infected machine.

This is the same social engineering playbook North Korea's Lazarus Group used in Operation Dream Job, where defense sector professionals were lured with fabricated job offers. WaterPlum has industrialized the technique at scale across the cryptocurrency developer ecosystem.

The joint advisory identifies five distinct malware families currently active in WaterPlum operations. All five are delivered via the fake interview vector, and the group continues developing new variants.

BeaverTail is JavaScript-based malware embedded in npm packages. It functions as both a loader and an infostealer, downloading additional payloads from attacker-controlled infrastructure while simultaneously extracting browser credentials, saved passwords, and cryptocurrency wallet data from the victim's machine.

InvisibleFerret is a Python-based backdoor that establishes a persistent reverse shell and C2 channel. It is typically downloaded and executed by BeaverTail as a second-stage payload. InvisibleFerret's Python runtime allows it to operate cross-platform on macOS, Linux, and Windows developer workstations.

OtterCookie is a JavaScript remote-access trojan and infostealer. It captures keystrokes, screenshots, and clipboard contents. Clipboard harvesting is specifically targeted at cryptocurrency transactions: when a victim copies a wallet address to paste into a transfer field, OtterCookie records it for the attacker.

OtterCandy combines the capabilities of OtterCookie with additional RAT functionality for lateral movement and long-term persistence.

StoatWaffle is a modular Node.js malware family delivered exclusively through malicious Visual Studio Code projects. It abuses VSCode's .vscode/tasks.json configuration to auto-run commands when the developer opens the project directory and clicks "Trust this folder." StoatWaffle downloads additional payloads and establishes a persistent foothold without requiring any user interaction beyond the initial trust prompt.

The multi-family structure ensures redundancy: even if an endpoint security tool blocks one family, another continues operating.

WaterPlum's primary targets are individual software developers and IT professionals with direct access to cryptocurrency assets or their employers' codebases. The group systematically pursues web developers, blockchain engineers, NFT developers, and cryptocurrency specialists because these roles provide dual-value compromise: the developer's personal crypto holdings and a foothold into the organizations they work for.

The advisory confirms 30,000 infected devices across more than 100 countries from December 2025 through July 2026. Japan and the United States are specifically named as primary target geographies, with Europe also impacted. The multi-country reach reflects WaterPlum's use of automated outreach across global freelance platforms rather than country-specific targeting.

Beyond individual victims, WaterPlum actors pivot from compromised developer machines into employer networks, client repositories, and project infrastructure. A blockchain developer who runs a malicious npm package on their workstation gives WaterPlum access to their employer's AWS environment, GitHub organization, and any internal tooling accessible via the developer's credentials. This secondary pivot is how a single compromised developer becomes a supply chain incident for an entire technology organization.

WaterPlum also exploits victims as identity proxies. Credentials and identity documents stolen in earlier attacks are used to impersonate legitimate professionals when applying for corporate developer positions. The February 2026 dismantling of a North Korean IT worker laptop farm in Japan demonstrated that some WaterPlum actors simultaneously run the fake-interview operation and act as employed developers at victim organizations.

For the relationship between developer-targeting supply chain compromises and downstream customer exposure, see the Brevo supply chain attack post, where a single compromised CDN endpoint deployed malware to 100,000+ websites.

The FBI and Japan's National Police Agency assess that WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers Party of Korea. The 313 General Bureau is the same organizational unit that manages North Korea's conventional weapons research and production programs, establishing a direct funding link between cryptocurrency theft and weapons development.

The four-country advisory is the first formal multi-lateral attribution of WaterPlum to this specific organizational unit. Previous reporting by Unit 42 and other threat intelligence teams had attributed the Contagious Interview campaign to North Korea without naming the specific bureau.

WaterPlum actors and North Korean IT workers share operational infrastructure. The advisory notes they have used overlapping IP addresses to access laptop farms, job platforms, and crowdsourcing services. This infrastructure overlap suggests the two operations are staffed by the same personnel pool rather than distinct groups that happen to share resources.

The IT worker dimension of WaterPlum's operation creates an ongoing access problem beyond the initial compromise. A North Korean developer impersonating a legitimate hire has authorized access to internal systems, can exfiltrate intellectual property over time, and is protected from detection by appearing to perform legitimate work. The FBI's ongoing prosecution of US-based laptop farm operators demonstrates that the regime uses domestic facilitators in target countries to route access and payments.

WaterPlum's attack chain has five distinct phases, each requiring a different detection and response capability.

These two rules target the BeaverTail npm post-install shell spawn and the InvisibleFerret Python backdoor network callback. Both carry experimental status; validate against your endpoint telemetry log format before enabling automatic blocking.

The following steps address both the immediate response for a suspected WaterPlum compromise and the longer-term defensive controls that prevent initial access.