GoKawiilNorth Korea's WaterPlum hackers infect 30,000 devices via fake job coding tests, steal $10.7M
Cybersecurity agencies from Japan, the US, Australia and Germany issued a joint advisory identifying North Korea's WaterPlum group as the actor behind malware hidden in fake job application coding tests. The scheme has infected over 30,000 devices across 100 countries and compromised more than 7,000 crypto wallets, netting $10.71 million believed to fund the North Korean government.
GoKawiil's interpretation of the reporting above, not reported fact.
This tactic turns the hiring process itself into an attack vector, planting persistent remote access trojans that can resurface months later once victims land jobs at other companies, potentially giving North Korea a backdoor into future employers' systems. It's part of a broader pattern where the regime uses fake IT workers and recruitment schemes to generate hundreds of millions in illicit revenue annually, as seen in Amazon blocking over 1,800 suspected North Korean job applications since 2024.
- WaterPlum's malware has hit 30,000+ devices in 100 countries via fake coding assessments.
- Roughly 7,000 crypto wallets were drained for a total of $10.71 million in losses.
- Compromised devices can later be exploited to infiltrate victims' subsequent employers.
YubiKey 5C NFC Security Key — With North Korean actors targeting job applicants through fake coding tests to steal credentials and crypto, hardware-based authentication like a YubiKey adds a physical barrier attackers can't replicate remotely. It's a practical step for developers and crypto holders who want phishing-resistant login protection beyond passwords.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Jowi Morales, 2026-09-20
Published there as: “North Korea used job interviews to deploy malware on 30,000 devices during coding tests — WaterPlum group loots $10.7 million in crypto and plants persistent RATs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.