GoKawiilNorth Korean group WaterPlum breached 30,000 devices, stole $10.7M in crypto
A joint advisory from law enforcement in Japan, the US, Australia and Germany says the North Korean-linked group WaterPlum infected over 30,000 devices across more than 100 countries between December 2025 and July 2026. The hackers drained more than 7,000 cryptocurrency wallets and moved over $10.7 million worth of crypto assets to North Korea, using fake job interviews and malicious code disguised as coding tests or software projects to infect victims.
GoKawiil's interpretation of the reporting above, not reported fact.
This campaign shows North Korea continuing to weaponize the hiring process itself, turning tech job seekers into unwitting entry points for state-sponsored theft that helps fund weapons programs. The scale—tens of thousands of devices and multiple malware families—suggests a durable, evolving toolkit rather than a one-off scheme, making it a persistent risk for developers, recruiters, and crypto platforms alike.
- WaterPlum infected over 30,000 devices in 100+ countries between Dec 2025 and July 2026.
- Attackers used fake job interviews and malicious code projects to deliver malware like BeaverTail, InvisibleFerret, and OtterCookie.
- Stolen funds exceeding $10.7 million in cryptocurrency were funneled to North Korea, likely supporting its weapons programs.
YubiKey 5 NFC Security Key — With North Korean hackers like WaterPlum targeting job seekers through fake interviews and malicious downloads, hardware-based two-factor authentication is a smart layer of defense for crypto wallets, email, and developer accounts. A YubiKey helps ensure that even if malware steals your passwords, attackers can't log into your critical accounts without the physical key in hand.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-19
Published there as: “North Korean WaterPlum hackers infected 30,000 devices worldwide”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.