GoKawiilNorth Korean group WaterPlum infects 30,000 devices via fake coding tests, steals $10.7M
Authorities in Australia, Germany, Japan and the US say a North Korean hacking group known as WaterPlum has compromised over 30,000 devices and 7,000 crypto wallets by posing as recruiters and sending malware-laced coding tests to tech workers. The scheme has netted at least $10.71 million in cryptocurrency, funneled back to North Korea.
GoKawiil's interpretation of the reporting above, not reported fact.
This shows how North Korea is blending cybercrime with its broader remote-work fraud schemes, using stolen credentials and identity documents to both steal funds and disguise IT workers seeking jobs abroad. The attack also creates downstream risk for employers if victims later use infected devices for legitimate work, potentially exposing corporate trade secrets and client data.
- WaterPlum uses fake job interviews and coding tests to deliver malware to tech and crypto workers.
- The campaign has compromised 30,000+ devices and stolen over $10.7 million in cryptocurrency.
- Stolen data and IDs may help North Korean operatives pose as legitimate remote IT workers abroad.
YubiKey 5 NFC Security Key — With fake job-offer malware campaigns stealing credentials and crypto-wallet data, hardware-based two-factor authentication like a YubiKey adds a critical layer of protection that malware can't easily bypass, even if your login info gets stolen. It's a simple, tangible way for developers and crypto users to harden their accounts against exactly this kind of credential-theft attack.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techspot.com — Skye Jacobs, 2026-09-21
Published there as: “Hackers use fake coding tests to infect 30,000 devices and steal $10 million in crypto”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.