An ongoing cybercriminal operation dubbed WaterPlum has been stealing cryptocurrency by masquerading as recruiters and staging fake technical interviews. Between December 2025 and July 2026, this North Korea–linked campaign, also called “Contagious Interview,” targeted over 30,000 computers across more than 100 countries and siphoned at least $10.7 million from over 7,000 wallets. The attack exposes how developers and employers alike are vulnerable to threats embedded in recruitment pipelines.
How the Scam Unfolds
WaterPlum exploits trusted hiring channels—including job boards, social media, freelance marketplaces, and direct networking—to reach software developers. Pretending to be potential employers, attackers ask candidates to complete coding tasks or fix issues in software tools during what appears to be a normal online interview. Instead of benign assignments, these tasks involve downloading and running files laced with malware.
The malicious payloads used include a range of tools—BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle—that grant remote access, harvest credentials, and steal project files. In some cases, the malware is concealed within blockchain-related projects, and Visual Studio Code’s configuration files are manipulated so that merely opening a modified folder triggers harmful code. More alarmingly, some call sessions feature AI-generated face swaps to simulate legitimacy.
Broader Risks and Mitigation
Beyond the individual victims, the danger extends to employers and clients who might be compromised via their staff or contractors. Attackers can steal browser logins, identity documents, and internal project data, paving the way for network intrusion or intellectual property theft. Some operations also use “laptop farms”—remotely controlled clusters of computers—to hide the true origin of the work. Such farms allow actors and their IT support to operate without revealing their real identity or location.
To defend against this growing threat, developers are urged not to run unknown code on devices that store sensitive data or wallets. Suspicious files should be tested in isolated environments; Visual Studio Code projects should only be opened under Restricted Mode unless the source is clearly verified. Organizations should vet subcontractors, limit external access, and rapidly revoke permissions or sessions when suspicions emerge. In cases where compromise is suspected, immediate measures include disconnecting from the internet, moving assets to a fresh wallet on another machine, and fully resetting the system.
WaterPlum leverages a longstanding principle: once trust is built—through a polished hiring process—it becomes easier for attackers to trick victims into installing malware. Even recruiting steps that seem normal can hide danger if source, identity, or environment checks are skipped.
Why this matters: WaterPlum represents a sophisticated escalation in social engineering campaigns, illustrating how attackers now weaponize recruitment tools to gain access to high-value assets. Developers and companies must assume that any unsolicited job offer—even one that appears legitimate—could carry risk. Vigilance around developer interviews, project sourcing, and remote access is no longer optional but essential. Watch closely for future advisories on IoCs like StoatWaffle, BeaverTail, and Visual Studio Code task file manipulation—they may be the canary in the coal mine for other such attacks.
