DPRK hacking group WaterPlum uses fake job listings to steal $10.71 million

Odaily reports that a joint alert from multiple international agencies, including the U.S. Federal Bureau of Investigation and Japan's National Police Agency, shows that the DPRK-linked hacking group WaterPlum, also known as Contagious Interview, posed as companies in the AI, cryptocurrency, or NFT sectors offering fake positions from December 2025 to July 2026, launching attacks against IT developers worldwide. The attackers approached job seekers through social media and recruitment platforms, luring them into downloading malicious files under the pretext of technical interviews or coding tests. They have infected more than 30,000 devices across over 100 countries and regions and stolen data from more than 7,000 crypto wallets; at least $10.71 million in funds flowed into wallets controlled by the attackers.