--- title: North Korea's WaterPlum hackers used fake job interviews... description: A joint advisory from Japanese, US, Australian, and German authorities has attributed a large-scale hacking campaign to a North Korean group called WaterPlum.... canonical: https://daily.dev/posts/north-korea-s-waterplum-hackers-used-fake-job-interviews-to-infect-30-000-devices-yoch52cka twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: North Korea's WaterPlum hackers used fake job interviews to infect 30,000 devices | daily.dev og:description: A joint advisory from Japanese, US, Australian, and German authorities has attributed a large-scale hacking campaign to a North Korean group called WaterPlum.... og:url: https://daily.dev/posts/north-korea-s-waterplum-hackers-used-fake-job-interviews-to-infect-30-000-devices-yoch52cka og:image: https://api.daily.dev/og/posts/YoCh52cka.png og:image:alt: North Korea's WaterPlum hackers used fake job interviews to infect 30,000 devices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # North Korea's WaterPlum hackers used fake job interviews to infect 30,000 devices **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary A joint advisory from Japanese, US, Australian, and German authorities has attributed a large-scale hacking campaign to a North Korean group called WaterPlum. The group posed as recruiters, invited job seekers to fake technical interviews, and had victims run malicious coding tests disguised as backdoor installers. The campaign infected around 30,000 devices and compromised over 7,000 cryptocurrency wallets, fitting a known pattern of North Korean state-linked crypto theft used to fund government operations. Developers who recently ran unfamiliar repositories during technical interviews are advised to check what that code actually did. ## Content A North Korea-linked group tracked under names like WaterPlum and Contagious Interview has been running fake job interviews at scale — and the damage is significant. A joint advisory from US, Japanese, Australian, and German authorities puts the toll at roughly 30,000 infected devices across more than 100 countries and over 7,000 drained cryptocurrency wallets. ## How the scam works The operation targets developers. Candidates get invited to what looks like a legitimate technical interview, then asked to complete a coding assessment. That assessment involves cloning a repository from Bitbucket, GitHub, or GitLab — one that contains hidden malware. The primary payload is a loader called BeaverTail. Once installed, it steals browser credentials, crypto wallet data, API tokens, and corporate access keys. Some victims, unaware they've been compromised, re-upload the malicious repositories themselves, spreading the campaign further without realizing it. Atlassian has taken down hundreds of malicious repositories and accounts tied to the campaign and published a full research report with indicators of compromise and infrastructure overlaps with other North Korea-linked operations. ## The fake IT worker side Separate from the interview lure, the same network runs a fake IT worker scheme. Security firm Nisos ran a sting on a suspected DPRK operative and found laptop farms, a network of 22 operators, and four US-based facilitators. Over a 10-month period, the group applied to 170,000 jobs and successfully landed 76 positions. AI is making this cheaper and more scalable. Synthetic personas, AI-assisted interviews, and generated resume content lower the barrier to entry. HR teams are the main line of defense here, and most aren't trained for it. ## Red flags worth knowing Experts from Nisos, KnowBe4, Kelly Services, and HireRight point to a consistent set of warning signs: - VoIP phone numbers with no verifiable history - Thin or inconsistent digital footprints - LinkedIn profiles that don't match resume timelines - Resume content duplicated across multiple applications Automating background checks and training recruiters to spot these patterns catches most cases before they become incidents. ## What to do if you're a developer or candidate Atlassian's guidance is practical: - Run take-home coding tests in an isolated environment (a VM or container, not your main machine) - Disable automatic task execution in VS Code before opening any unfamiliar project - If you think you've run something malicious, rotate all credentials immediately — browser-saved passwords, API keys, anything stored locally - Watch for unexpected IDE or terminal behavior during or after an assessment The broader pattern here is worth sitting with. These aren't opportunistic attacks — they're sustained, well-resourced operations that have been running long enough to infect tens of thousands of devices. The fake interview format works because it exploits a normal, trusted part of the hiring process. That's what makes it hard to defend against without changing how that process works. ## Questions this post answers ### What is the WaterPlum hacking group and how does it target job seekers? WaterPlum is a North Korean state-linked hacking group that poses as recruiters, invites job seekers to fake technical interviews, and has them run bogus coding tests that are actually backdoor malware installers. A joint advisory from Japanese, US, Australian, and German authorities linked the group to roughly 30,000 infected devices and more than 7,000 compromised cryptocurrency wallets worldwide. _Developers preparing for technical interviews can follow security advisories like this on daily.dev to spot fake coding-test scams._ ### How many devices and crypto wallets were affected by the WaterPlum campaign? Around 30,000 devices were infected and more than 7,000 cryptocurrency wallets were drained in the campaign attributed to WaterPlum. The exact amount of cryptocurrency stolen was not disclosed, but the scale of compromised wallets suggests a significant haul, consistent with North Korea's documented pattern of using crypto theft to fund state operations. _Security-conscious engineers track the scale of state-sponsored crypto theft campaigns through sources like daily.dev._ ## Similar posts on daily.dev - [North Korean fake IT worker tradecraft exposed](https://daily.dev/posts/north-korean-fake-it-worker-tradecraft-exposed-fhp45rckf) · CSO Online · 1 upvotes · 0 comments - [North Korea’s Contagious Interview Campaign Spreads Across 5...](https://daily.dev/posts/north-korea-s-contagious-interview-campaign-spreads-across-5--8ubvqs6zc) · Socket · 3 upvotes · 1 comments - [North Korea’s ‘Job Test’ trap upgrades to JSON malware dropboxes](https://daily.dev/posts/north-korea-s-job-test-trap-upgrades-to-json-malware-dropboxes-fr4pgnjuf) · InfoWorld · 0 upvotes · 0 comments - [North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews](https://daily.dev/posts/north-korean-purplebravo-campaign-targeted-3-136-ip-addresses-via-fake-job-interviews-sgrgwy6to) · The Hacker News · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/north-korea-s-waterplum-hackers-used-fake-job-interviews-to-infect-30-000-devices-yoch52cka) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"North Korea's WaterPlum hackers used fake job interviews to infect 30,000 devices","url":"https://daily.dev/posts/north-korea-s-waterplum-hackers-used-fake-job-interviews-to-infect-30-000-devices-yoch52cka","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/north-korea-s-waterplum-hackers-used-fake-job-interviews-to-infect-30-000-devices-yoch52cka"},"datePublished":"2026-09-19T14:31:48.281Z","dateModified":"2026-09-25T15:42:12.818Z","description":"A joint advisory from Japanese, US, Australian, and German authorities has attributed a large-scale hacking campaign to a North Korean group called WaterPlum....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/816a28d3185bb206f73eab363228b8f5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/816a28d3185bb206f73eab363228b8f5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/north-korea-s-waterplum-hackers-used-fake-job-interviews-to-infect-30-000-devices-yoch52cka","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"North Korea's WaterPlum hackers used fake job interviews to infect 30,000 devices"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/north-korea-s-waterplum-hackers-used-fake-job-interviews-to-infect-30-000-devices-yoch52cka#faq","mainEntity":[{"@type":"Question","name":"What is the WaterPlum hacking group and how does it target job seekers?","acceptedAnswer":{"@type":"Answer","text":"WaterPlum is a North Korean state-linked hacking group that poses as recruiters, invites job seekers to fake technical interviews, and has them run bogus coding tests that are actually backdoor malware installers. A joint advisory from Japanese, US, Australian, and German authorities linked the group to roughly 30,000 infected devices and more than 7,000 compromised cryptocurrency wallets worldwide. Developers preparing for technical interviews can follow security advisories like this on daily.dev to spot fake coding-test scams."}},{"@type":"Question","name":"How many devices and crypto wallets were affected by the WaterPlum campaign?","acceptedAnswer":{"@type":"Answer","text":"Around 30,000 devices were infected and more than 7,000 cryptocurrency wallets were drained in the campaign attributed to WaterPlum. The exact amount of cryptocurrency stolen was not disclosed, but the scale of compromised wallets suggests a significant haul, consistent with North Korea's documented pattern of using crypto theft to fund state operations. Security-conscious engineers track the scale of state-sponsored crypto theft campaigns through sources like daily.dev."}}]} ```