Crime21 September, 20262 min read
WaterPlum Posed as Crypto And AI Recruiters, Stole At Least $10.7 Million
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
WaterPlum, North Korea-linked, posed as recruiters for crypto/AI firms, stealing at least $10.7 million. Infected about 30,000 devices across more than 100 countries with malware.
9 outlets told this the same way.
Fake recruiters, stolen crypto
WaterPlum, also known as Contagious Interview, posed as recruiters for cryptocurrency and artificial intelligence companies and stole at least $10.7 million by infecting at least 30,000 devices in more than 100 countries. The joint advisory described how WaterPlum targeted software developers and information technology professionals worldwide by impersonating recruiters at real AI, cryptocurrency and non-fungible token (NFT) companies or by using legitimate hiring services.
The advisory said WaterPlum compromised funds and account credentials from more than 7,000 crypto wallets between December 2025 through July 2026. The advisory also said the attackers persuaded candidates to run malicious files disguised as coding tests or software meant to fix video-conferencing problems, and then used remote-access trojans and information-stealing malware to take sensitive data and crypto assets.
Authorities link to North Korea
Japanese and US authorities assessed that WaterPlum actors and some North Korean IT workers operate under North Korea's Munitions Industry Department, according to the advisory cited by Cointelegraph. The advisory described a case where a suspected North Korean IT worker applied for an engineering role at a Japanese crypto exchange using a falsified resume, and the exchange declined to hire the candidate after finding discrepancies during the interview.
The advisory said stolen personal data could be used to help North Korean IT workers disguise their identities, and it warned that stolen identification documents could be used to impersonate victims, earn income from overseas companies or use sensitive information for extortion. The advisory also said the primary targets were individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies.
What comes next
The advisory said stolen identity documents could help North Korean IT workers impersonate victims and obtain employment, while sensitive information obtained from compromised devices could be used for extortion. The advisory also described how successful infections could create a route into companies that employ the infected developers, because attackers could infiltrate organizations that employ the unsuspecting developers.
The advisory tied the campaign to a broader North Korea strategy of placing IT workers inside foreign companies, with Japanese and US authorities assessing that WaterPlum actors and some North Korean IT workers operate under North Korea's Munitions Industry Department. The advisory said the campaign's reported window ran from December 2025 through July 2026, when it reported infections and cryptocurrency transfers occurred.