{
 "tag": "fake-job-interview",
 "name": "Fake Job Interview",
 "group": "Other",
 "incidents": [
  {
   "slug": "waterplum-contagious-interview-advisory-sep-2026",
   "title": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026",
   "json": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The attackers reportedly use AI face-swapping software during online job interviews, then turn off their cameras and blame network problems."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto, AI and NFT developers and job seekers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "waterplum",
    "contagious-interview",
    "fake-job-interview",
    "npm",
    "vscode",
    "beavertail",
    "invisibleferret",
    "ottercookie",
    "stoatwaffle",
    "infostealer",
    "ai"
   ],
   "amountUsd": 10710000,
   "victims": 7000,
   "startedAt": "2026-09-18",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped."
  },
  {
   "slug": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "title": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "json": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Web3 and crypto executives, founders and blockchain developers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "lazarus",
    "ghostcall",
    "ghosthire",
    "snatchcrypto",
    "fake-meeting",
    "fake-job-interview",
    "telegram",
    "github",
    "macos",
    "kaspersky",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-10-28",
   "closedAt": "2025-10-28",
   "updatedAt": "2025-10-28T12:00:00Z",
   "summary": "Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given."
  }
 ],
 "changes": [
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-19",
   "title": "BleepingComputer reported the advisory's figures: 30,000+ infected devices, 7,000+ wallets hit and over 1.7 billion yen stolen.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-18",
   "title": "Japan, the US, Australia and Germany issued a joint advisory on WaterPlum covering activity from December 2025 to July 2026.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "incidentTitle": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-28",
   "title": "Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.",
   "sourceUrl": "https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025"
  }
 ]
}