A joint cybersecurity advisory from Japan, the U.S., Australia, and Germany says the North Korean Contagious Interview campaign has compromised at least 30,000 devices across more than 100 countries and pulled funds or credentials from over 7,000 cryptocurrency wallets.
The campaign targets individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3. Estimated losses so far: at least $10.71 million in cryptocurrency.
The group is tracked under many names, including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi, and WaterPlum. According to the alert, it "conducts cyber attacks by infiltrating unsuspecting job seekers' computer networks, harvesting sensitive information, and stealing cryptocurrency."
WaterPlum and some North Korean IT workers (also called PurpleDelta or Wagemole) are suspected of operating under the 313 General Bureau of the Munitions Industry Department, backing a June 2025 DTEX assessment. The two clusters are described as deeply intertwined, sometimes sharing IP addresses when accessing laptop farms and applying to Japanese cryptocurrency exchanges.
First exposed by Palo Alto Networks Unit 42, Contagious Interview has run since at least 2022, approaching software developers and IT professionals on social platforms such as LinkedIn with fake job offers. After building rapport, the actors ask targets to complete a job assessment or coding test, setting off a multi-step infection chain that drops malware including BeaverTail, InvisibleFerret, FlexibleFerret, GolangGhost, PylangGhost, OtterCookie, RATatouille, OtterCandy, and StoatWaffle. The resulting backdoor access is used to deliver remote access trojans for persistent access and data exfiltration.
Some WaterPlum actors also work as North Korean IT staff doing web system design and development for corporate clients, the agencies said, adding that a laptop farm run by a facilitator in Japan was identified and dismantled. WaterPlum has used online chat platforms to talk with U.S. and Japanese developers, relying on enablers in Japan, the U.S., and elsewhere to set up and manage laptop farms.
"Beyond immediate credential theft, successful infections provide WaterPlum actors opportunities to infiltrate organizations employing targeted developers, enabling espionage, intellectual property theft, and additional lateral movement in corporate environments," the agencies noted. Stolen ID images can also be used by North Korean IT workers to impersonate victims and generate foreign currency.
Separately, the IT worker scheme keeps expanding. A July 2026 Kudelski Security analysis of related infrastructure found the main targets appear to be the U.S. and Japan, with actors using VPN services such as Astrill VPN and Mullvad to obtain exit nodes there. Silent Push reported last week that it found a North Korean IT worker running a fake recruitment scam through a Discord server called "Mouse Review," hiring people in the U.S., the E.U., and Latin America to act as proxies and sit through job interviews.
The AI-generated ad claims: "YOUR ROLE IS SIMPLE, BUT CRUCIAL. You handle communications and interviews. I handle all technical work behind the scenes. You get paid consistently for your communication." Facilitators who land a job can earn between $3,000 and $5,000, it continues, offering remote screen access for live coding challenges. Silent Push said the goal is proxy hiring, using Western or Latin American citizens as the "face" and legal identity to bypass sanctions, KYC controls, and regional hiring restrictions, with a 35% to 65% split favoring the North Korean IT worker.
Source: The Hackers News