North Korean WaterPlum hackers infected 30,000 devices worldwide
North Korean WaterPlum hackers infected 30,000 devices worldwide and stole over $10.7M in crypto.
A joint advisory from US, Japanese, Australian, and German authorities details the activities of the North Korean hacking group WaterPlum. The group compromised over 30,000 devices globally between December 2025 and July 2026, stealing more than $10.7 million in cryptocurrency and exfiltrating credentials and sensitive data. WaterPlum is linked to the 'Contagious Interview' campaign, using malicious npm packages and impersonating AI/crypto companies to target job seekers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe WaterPlum group exploited two compounding weaknesses: a poisoned open-source software supply chain via malicious npm packages, and social engineering that preyed on job seekers unaware of impersonation tactics. By embedding malware in packages that developers routinely trust and install, attackers gained immediate footholds on developer workstations with minimal friction. The campaign's success—30,000 devices compromised and $10.7 million stolen—demonstrates how supply chain attacks amplify reach far beyond direct targeting. Organizations that lack vetting processes for third-party packages and employees who cannot recognize recruitment-based social engineering remain critically exposed to this growing attack vector.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — BeaverTail
- malware — InvisibleFerret
- malware — OtterCookie
- malware — OtterCandy
- malware — StoatWaffle