GoKawiilNorth Korean hackers infected 30,000 devices via fake job coding tests, agencies say
Security agencies from Japan, the US, Australia, and Germany issued a joint advisory linking the North Korean group WaterPlum to malware embedded in fake job interview coding assignments. The scheme has infected over 30,000 devices in 100 countries, compromised more than 7,000 crypto wallets, and caused losses of $10.71 million, with funds believed to flow to the North Korean government.
This shows how North Korea blends cybercrime with its broader state-sponsored IT worker fraud, reportedly worth $500 million a year, by using stolen credentials to infiltrate legitimate companies like Amazon. Because the malware persists long after the fake interview, compromised job seekers can unknowingly become entry points for attacks on their real future employers.
- WaterPlum's fake coding tests hid malware infecting over 30,000 devices across 100 countries.
- Stolen crypto and credentials, worth $10.71 million, are believed to fund North Korea's government.
- Persistent remote access trojans let hackers later target victims' legitimate employers, including Amazon.
Yubico YubiKey 5C NFC Security Key — With North Korean actors stealing credentials and crypto wallets through fake job tests, hardware-based two-factor authentication is one of the strongest defenses against credential theft. A YubiKey ensures that even if malware captures your passwords, attackers can't access your accounts without the physical key in hand.》
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Jowi Morales, 2026-09-20
Published there as: “North Korea used job interviews to deploy malware on 30,000 devices during coding tests”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.