A joint warning cited by Forbes says a North Korea-linked hacking group known as WaterPlum, also called Contagious Interview, targeted IT developers worldwide through fake job offers between December 2025 and July 2026. The alert was issued by multiple agencies, including the U.S. Federal Bureau of Investigation and Japan’s National Police Agency.
According to the warning, the attackers posed as companies in the AI, cryptocurrency, and NFT sectors. They approached job seekers on social media and recruitment platforms, then used supposed technical interviews or coding tests to persuade targets to download malicious files. Authorities said the campaign infected more than 30,000 devices across over 100 countries and regions.
The warning also said data was stolen from more than 7,000 crypto wallets, and at least $10.71 million was traced to wallets controlled by the attackers. The case adds to a growing list of cyber operations tied to fake hiring processes aimed at developers and crypto users.
According to Forbes, a joint warning issued by multiple agencies, including the U.S. Federal Bureau of Investigation (FBI) and Japan’s National Police Agency (NPA), said the North Korea-linked hacking group WaterPlum, also known as Contagious Interview, targeted IT developers worldwide through fake recruitment campaigns from December 2025 to July 2026.
Attackers posed as firms in AI, crypto, and NFT
The warning said the group impersonated companies in the AI, cryptocurrency, and NFT sectors. It contacted job seekers through social media and recruitment platforms, then used supposed technical interviews or coding tests as a pretext to get targets to download malicious files.
More than 30,000 devices were infected
Authorities said the operation successfully infected more than 30,000 devices across over 100 countries and regions. The warning also said data was stolen from more than 7,000 crypto wallets.
At least $10.71 million reached attacker-controlled wallets
The joint alert said at least $10.71 million flowed into wallets controlled by the attackers.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
