Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets
Crypto, AI and NFT developers and job seekers
On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped.
Why this severity: $11M reported stolen, 7,000 victims, still active.
AI involvement
AI-made lures. The attackers reportedly use AI face-swapping software during online job interviews, then turn off their cameras and blame network problems.
Check anyone who asks for money, a signature or a download on a second channel you already trust. A familiar face or voice on a call is no longer proof.
- Started
- Sep 18, 2026
- Chains
- Multiple EVM chains
- Reported stolen
- $11M
- Victims
- 7,000
At risk
- Crypto, AI and NFT developers and job seekers
- Multiple EVM chains wallets
What to do now
- From a different, clean device, create new wallets and move your funds. Assume every seed, private key and browser-saved password on the infected machine is stolen.
- Reinstall the operating system on the infected machine, then change passwords and rotate API keys, SSH keys and 2FA.
Stay safe
Am I affected?
If in the past year you did a job interview, coding test or 'technical assessment' for a crypto, AI or NFT company and ran a repo, npm package or VS Code project they gave you, or ran a command to fix a video-call problem, treat that computer as compromised.
What to do now
- From a different, clean device, create new wallets and move your funds. Assume every seed, private key and browser-saved password on the infected machine is stolen.
- Reinstall the operating system on the infected machine, then change passwords and rotate API keys, SSH keys and 2FA.
How to avoid this
- Run interview code only in a throwaway virtual machine or cloud sandbox with no wallets or logins on it.
- Don't mark unknown folders as trusted in VS Code; read package.json scripts and .vscode/tasks.json first.
- Never paste a command from a recruiter or 'support' to fix your camera or microphone.
Timeline 2
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.