WaterPlum Group Targets IT Professionals via Contagious Interview Campaign

A joint international advisory from the FBI, NPA Japan, and other global agencies has exposed 'WaterPlum' (also known as Contagious Interview), a North Korean threat group targeting software developers and IT professionals. The group is assessed to operate under the 313 General Bureau of the Munitions Industry Department. Since December 2025, the campaign has infected at least 30,000 devices across 100 countries, resulting in the theft of $10.71 million USD in cryptocurrency from over 7,000 wallets.

The attack chain involves social engineering on platforms like LinkedIn and Discord, where actors pose as recruiters for AI or NFT companies. During the technical interview process, victims are tricked into downloading malicious Node Package Manager (NPM) packages or opening Visual Studio Code projects that deploy a suite of custom malware including BeaverTail, InvisibleFerret, and StoatWaffle.

This activity is deeply intertwined with the North Korean IT worker scheme, where actors use 'laptop farms' and identity mules to bypass sanctions and secure legitimate corporate employment. The business impact extends beyond immediate financial theft to potential corporate espionage, as compromised personal developer machines often provide a bridgehead into employer networks and source code repositories.