A North Korea-linked hacking group known as WaterPlum has used fake job offers and online interviews to compromise at least 30,000 devices across more than 100 countries, according to a joint report from security agencies in the United States, Japan, Germany and Australia.
The attackers reportedly posed as employers and targeted programmers and cryptocurrency professionals, asking candidates to participate in online interviews and download and execute files as part of recruitment tests.
The files contained malware, allowing the attackers to access victims’ personal information and cryptocurrency wallets. The campaign therefore used the hiring process itself as a delivery mechanism for malicious software.
According to the report, the attacks between December 2025 and July 2026 resulted in the theft of information or assets from more than 7,000 cryptocurrency wallets.
At least $10.71 million in cryptocurrency was transferred to North Korea as a result of the campaign, highlighting the financial impact of the attacks alongside the broader compromise of devices and wallet data.
Cybersecurity experts have warned programmers to verify the legitimacy of companies and the origin of files before executing software or code received during recruitment processes.
The key security concern is the use of seemingly legitimate employment opportunities to persuade technically skilled users to execute malicious files. For cryptocurrency users, the compromise of wallet information can also directly expose digital assets to theft.
