Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

1. Executive summary

A joint advisory from cybersecurity and intelligence agencies in Japan, the US, Australia and Germany reports that the North Korean Contagious Interview campaign, tracked by the issuing agencies as WaterPlum, has compromised at least 30,000 devices across more than 100 countries and drained funds or credentials from over 7,000 cryptocurrency wallets, with thefts of at least $10.71 million attributed to the activity. The campaign poses as recruiters and employers on platforms including LinkedIn, then tricks targeted developers and IT professionals into running malware disguised as job assessments or coding tests. The agencies state that successful infections give the operators a route into the organisations that later employ the targeted jobseekers, enabling espionage, intellectual property theft and lateral movement in corporate environments. Attribution to North Korea rests on the joint advisory and supporting vendor research; the verified reference data confirms a MITRE profile only for Lazarus Group (G0032), and the advisory names WaterPlum rather than Lazarus, so attribution beyond the issuing agencies' assessment is unconfirmed in our reference data. For EMEA financial services the exposure is twofold: staff who job-hunt on LinkedIn and similar platforms can be infected on personal or corporate devices, and stolen identity documents and credentials feed the parallel North Korean IT worker scheme, which the advisory links to the same operational milieu.

2. Regulatory framing

3. Technical analysis & attack chain

The attack chain below is drawn from the joint advisory as reported by The Register and The Hacker News. No CVE, product version, port or protocol detail is present in the source material, so none is stated here.

1. Target selection. Operators select individual web designers, engineers and specialists in cryptocurrency, blockchain and Web3 technologies, and approach them on social media platforms including LinkedIn while posing as recruiters or prospective employers offering lucrative jobs. The campaign has run since at least 2022 and was first exposed by Palo Alto Networks Unit 42.
2. Rapport and tasking. Once initial rapport is established, the target is instructed to complete a job assessment or coding test. In some cases the actors use online chat platforms to communicate with US and Japanese developers.
3. Payload delivery. The victim downloads files presented as coding assignments or recruitment tests. Opening them backdoors the machine and installs malware.
4. Post-exploitation. The multi-step infection chain deploys a range of malware families named in the advisory: BeaverTail, InvisibleFerret, FlexibleFerret, GolangGhost, PylangGhost, OtterCookie, RATatouille, OtterCandy and StoatWaffle. The actors then deploy remote access trojans and information stealers, giving persistent access to credentials and other sensitive data long after the fake interview ends.
5. Data access and monetisation. The operators steal intellectual property, credentials, clipboard contents, keystrokes, cryptocurrency wallet data and identity documents. Stolen ID images can be used by North Korean IT workers to impersonate victims and generate foreign currency; stolen credentials can be used to exfiltrate crypto assets, personal data and trade secrets from victims' employers, clients or contracting parties; the actors can also use stolen sensitive information for extortion.
6. Corporate follow-on. The advisory states that beyond immediate credential theft, successful infections give WaterPlum actors opportunities to infiltrate the organisations employing the targeted developers, enabling espionage, IP theft and additional lateral movement in corporate environments.

Scale and attribution detail. The agencies attribute at least $10.71 million in thefts to these tactics, with proceeds funneled to Pyongyang, from more than 7,000 compromised cryptocurrency wallets across at least 30,000 devices in over 100 countries. The broader community tracks the activity under the monikers CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi and WaterPlum. The advisory assesses that both WaterPlum and some North Korean IT workers (PurpleDelta or Wagemole) operate under the 313 General Bureau of the Munitions Industry Department, corroborating a June 2025 DTEX assessment, and that the two clusters are intertwined, in some cases using the same IP addresses when accessing laptop farms and applying for positions at Japanese cryptocurrency exchanges. A laptop farm operated by a facilitator in Japan has been identified and dismantled. Enablers in Japan, the US and other countries set up and manage laptop farms for remote device management.

Confidence caveats. The malware family names, the 313 General Bureau linkage and the PurpleDelta/Wagemole overlap come from the joint advisory as relayed in single-source press coverage of it; we have not seen the advisory PDF itself, so treat the family list and the bureau linkage as single-sourced until verified against the primary document. The verified reference data carries a MITRE profile only for Lazarus Group (G0032); the advisory attributes the campaign to North Korean state actors under the WaterPlum label and does not name Lazarus, so we do not assert a Lazarus attribution. The July 2026 macOS malvertising variant described by The Hacker News (fake update pages delivering crypto-stealing malware) is reported as a new iteration of Contagious Interview, but the fetched source is truncated before technical detail, so we do not describe its mechanics.

4. Mitigation & containment

P1, within 24 hours:

• Hunt for the campaign's behavioural footprint rather than atomic indicators, since the source material contains no hashes, domains or IPs. Query endpoint and proxy telemetry for developer and engineering staff who were contacted by unfamiliar recruiters in the period before any unusual downloads, and for execution of downloaded "coding test" or "assignment" archives on developer machines.
• If an infection is confirmed on a corporate or BYOD device, isolate the host, revoke and rotate all credentials, session tokens and API keys used from it, and drain and re-secure any cryptocurrency wallets or exchange accounts accessed from it. Assume clipboard contents and keystrokes were captured.
• Where an infected jobseeker has since joined your organisation, treat their onboarding period as a potential ingress window: review authentication from their devices, VPN session origins and any anomalous access to source code repositories or client systems.

P2, within 72 hours:

• Brief engineering, design and Web3-facing staff that recruiter approaches on LinkedIn and chat platforms are the initial access vector, and that downloaded "job assessments" are the payload mechanism. Give them a reporting route for suspicious approaches.
• Add detection coverage for the named post-exploitation tooling: BeaverTail, InvisibleFerret, FlexibleFerret, GolangGhost, PylangGhost, OtterCookie, RATatouille, OtterCandy and StoatWaffle. These names are the extent of the technical detail in the source; obtain signatures from your EDR vendor or the advisory PDF rather than expecting them here.
• Screen recent developer and contractor hires for the IT worker fraud indicators the advisory lists: resumes claiming prestigious education and extensive experience that do not withstand interview scrutiny, repeated refusals to meet in person, suspicious video feed interruptions, background voices, requests for payment in cryptocurrency, and AI face-swapping artifacts on video calls, including candidates who disable cameras shortly after a call begins.

P3, within 7 days:

• Extend third-party risk processes to cover staffing suppliers and outsourced web development, per the DORA Art. 28 and NIS2 Art. 21(2)(d) triggers above: verify contractor identity with document checks, require in-person or continuous-camera interviews for developer roles, and restrict remote access for new contractors until identity assurance is complete.
• If the screening or hunting above suggests you have engaged a fraudulent North Korean IT worker, the advisory recommends a full forensic investigation and the assumption that credentials and other sensitive data have been compromised. Plan that investigation to produce evidence suitable for an Art. 19 major incident report where applicable.

5. Indicators of compromise

No indicators of compromise available in the source material. The joint advisory as relayed by the press reports contains no hashes, domains, IP addresses, file paths or mutexes.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material names malware families and describes behaviours but provides no strings, file names, paths, registry keys, command lines or hashes from the malicious artefacts themselves. A rule built from the family names or the campaign name would detect reporting about the threat, not the threat. Obtain the joint advisory PDF for technical indicators and vendor signatures for the named families.

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

7. Sources

• The Hacker News, "Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto", https://thehackernews.com/2026/09/contagious-interview-campaign.html, 2026-09-21
• The Register Security, "North Korea's fake job interviews infected 30,000 devices", https://www.theregister.com/security/2026/09/18/north-koreas-fake-job-interviews-infected-30000-devices/5297461, 2026-09-18
• The Hacker News, "DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware", https://thehackernews.com/2026/07/dprk-linked-macos-malvertising-uses.html, 2026-07

8. Adverse Trace position

We assess this as a high-impact, high-confidence campaign for EMEA financial services, on the strength of a four-nation joint advisory corroborated across two independent outlets, though the technical detail available to us is thin: the press coverage carries no IOCs, so enforcement actions this week must be behavioural hunting and staff awareness rather than indicator blocking. The distinctive risk to our clients is the bridge the advisory draws between recruiter-lure infections and the IT worker scheme: stolen identity documents and credentials from jobseekers feed worker impersonation, and the same actors are assessed to operate both clusters, which makes developer hiring and contractor onboarding a security control surface and not solely an HR process. Attribution to North Korea is the issuing agencies' assessment and is plausible given the revenue flow to Pyongyang, but our verified reference data confirms a MITRE profile only for Lazarus Group (G0032) and the advisory does not use that name, so we treat actor attribution as agency-sourced and unconfirmed against our own reference data. We will obtain the joint advisory PDF, extract its IOC set and any malware configuration detail, and issue a follow-up with detection rules for the named families once primary-source artefacts are in hand.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.