North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
North Korean WaterPlum (Contagious Interview) Hackers Target (TL-2026-2577), also tracked as Contagious Interview, is a high-severity advanced persistent threat campaign, first published 2026-09-19. It is attributed to WageMole (North Korea) with high confidence, affects Node.js Foundation / npm, Inc. npm registry / npm CLI, maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1056), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-2577
- Threat ID
- TL-2026-2577
- Also known as
- Contagious Interview, ClickFake Interview
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-09-19
- Last reviewed
- 2026-09-19
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, financial services, cryptocurrency, blockchain web3
- Target regions
- Global (100+ countries), japan, united states of america, australia, germany
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in North Korean WaterPlum (Contagious Interview) Hackers Target
Malware and tooling: BeaverTail - S1246, HexEval, InvisibleFerret - S1245, OtterCandy, OtterCookie, StoatWaffle, XORIndex, AnyDesk, socket.io-client
DPRK state-sponsored actor WaterPlum (aka Contagious Interview), operating under North Korea's 313 General Bureau, Munitions Industry Department, runs fake job-recruitment and AI face-swapped technical interviews against web developers, freelancers, and blockchain/cryptocurrency professionals to deploy BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware via trojanized npm packages and malicious VS Code projects. Between December 2025 and July 2026 the campaign compromised 30,000+ devices across 100+ countries and 7,000+ cryptocurrency wallets, stealing roughly JPY 1.7 billion (~$10.71M); it was formally attributed on 2026-09-18 by a joint Japan-US-Australia-Germany law-enforcement advisory.
How North Korean WaterPlum (Contagious Interview) Hackers Target works
WaterPlum, publicly tracked as "Contagious Interview" (and overlapping with the related "ClickFake Interview" campaign and the Google/Mandiant-tracked cluster UNC5342), is a North Korean state-sponsored threat actor linked to DPRK IT-worker laptop-farm operations. The group poses as recruiters for AI, cryptocurrency, and NFT companies on LinkedIn, job boards, and freelance marketplaces, luring web developers, blockchain specialists, and cryptocurrency professionals into a fake technical interview or coding assessment. Victims are told to download and run "test" code hosted on GitHub, Bitbucket, or delivered via Google Docs assignments; during video calls, operators use AI face-swapping and disable video feeds citing connectivity issues to mask a single operator running many fabricated identities.
The malicious code is distributed chiefly through the npm software supply chain: typosquatted and postinstall-hook-laden packages (e.g., react-plaid-sdk, reactbootstraps, vite-plugin-next-refresh, node-orm-mongoose) and compromises of legitimate packages (rand-user-agent) deliver a layered malware stack. BeaverTail, a JavaScript infostealer/loader active since at least 2022, harvests browser data and cryptocurrency-wallet extensions and stages the cross-platform Python backdoor InvisibleFerret for remote control, keylogging, and file theft. OtterCookie, most recently merged with BeaverTail into a modular "OtterCookie v5" JS suite, adds a remote-shell module (via the socket.io-client npm package) and installs AnyDesk for persistent remote-hands-on-keyboard access. OtterCandy, a hybrid of OtterCookie and the RATatouille RAT first spread via the May 2025 rand-user-agent compromise, adds anti-forensic capability and has been active since July 2025. StoatWaffle, distributed since December 2025, abuses Visual Studio Code's tasks.json "runOn: folderOpen" auto-run feature to execute Node.js code the moment a malicious blockchain-themed repository is opened, then steals browser and macOS iCloud Keychain credentials via stealer and RAT modules; Microsoft mitigated the underlying auto-run behavior in VS Code 1.109/1.110. Loader families HexEval and XORIndex (the latter spread via 67 packages with 17,000+ downloads) fingerprint hosts and pull further payloads via eval(). Since October 2025, related infrastructure (UNC5342) has used "EtherHiding" — storing encrypted payload/C2 pointers inside BNB Smart Chain and Ethereum smart contracts — as a nation-state-first blockchain dead-drop-resolver C2 technique.
Exfiltrated data spans browser-stored credentials and cookies, clipboard contents, keystrokes, screenshots, cryptocurrency private keys and seed phrases, identity documents, and source code. On 2026-09-18, Japan's National Police Agency and National Cybersecurity Office, the US FBI and Defense Department Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND/BfV jointly attributed the campaign to North Korea's 313 General Bureau, Munitions Industry Department, and published a coordinated advisory (IC3 CSA-260918) alongside recommended mitigations for developers and organizations.
MITRE ATT&CK techniques used in TL-2026-2577
Collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1219 Remote Access Tools
Discovery
T1082 System Information Discovery
Initial Access
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Resource Development
Affected products and versions in North Korean WaterPlum (Contagious Interview) Hackers Target
- Node.js Foundation / npm, Inc. — npm registry / npm CLI
Vulnerable versions: N/A - abuse of package publishing and postinstall hooks as a distribution vector, not a code vulnerability
Fixed in: N/A - mitigated by package removal, provenance checks, and ignore-scripts policy, not a patch - Microsoft — Visual Studio Code
Vulnerable versions: < 1.109 (task.allowAutomaticTasks enabled by default, allowing runOn: folderOpen auto-execution)
Fixed in: 1.109 (auto-run tasks default off); 1.110 (adds workspace-open auto-run warning prompt)
Remediation for North Korean WaterPlum (Contagious Interview) Hackers Target
Patches
- Visual Studio Code 1.109 (task.allowAutomaticTasks defaults to off)
- Visual Studio Code 1.110 (adds a workspace-open warning for auto-run tasks; workspace-level settings can no longer silently override the default)
Immediate actions
- Run any untrusted interview/coding-test code only inside an isolated VM, container, or disposable sandbox, never on a primary or corporate workstation
- Treat any interview task or 'debug this' request that runs curl, base64, -enc, mshta, or Invoke-WebRequest as malicious and halt the process
- Open unfamiliar GitHub/Bitbucket repositories in VS Code with Workspace Trust / Restricted Mode enabled and inspect .vscode/tasks.json before opening a folder
- Update Visual Studio Code to 1.110 or later so auto-run tasks are disabled by default and a workspace-open warning is shown
- Audit developer and CI/CD environments for the identified malicious/typosquatted npm packages and remove them
- Rotate browser-stored credentials and move cryptocurrency held in any wallet accessed on a machine used for an unsolicited technical interview to a new wallet
Workarounds
- On VS Code versions prior to 1.109, manually set task.allowAutomaticTasks to off in user settings
- Disable npm postinstall script execution when evaluating unknown packages (npm install --ignore-scripts)
Longer-term hardening
- Deploy EDR with behavioral detection tuned to Node.js/Python child processes spawned from IDEs, unexpected AnyDesk installs, and browser credential-store access
- Enforce npm package allowlisting or a private-registry proxy with provenance/postinstall-script controls (npm config set ignore-scripts true) on developer endpoints
- Provide security-awareness training to developers, freelancers, and recruiting teams on fake-recruiter and technical-interview social engineering, including AI face-swap red flags
- Monitor developer-workstation egress to Vercel apps, raw GitHub Gist content, and blockchain RPC endpoints (BNB Smart Chain/Ethereum) for anomalous polling consistent with EtherHiding C2
Weaknesses (CWE) in North Korean WaterPlum (Contagious Interview) Hackers Target
CWE-506
Timeline of North Korean WaterPlum (Contagious Interview) Hackers Target
- BeaverTail JavaScript infostealer first observed active; later becomes the primary first-stage payload for the Contagious Interview/WaterPlum campaign.
- Eleven malicious npm packages found deploying BeaverTail to developer machines (The Hacker News).
- Legitimate npm package rand-user-agent compromised in a supply-chain attack, distributing the RATatouille RAT that later merges into OtterCandy.
- OtterCandy (OtterCookie + RATatouille hybrid, with an anti-forensic module) first deployed in Contagious Interview operations, and later also in the related ClickFake Interview campaign.
- New BeaverTail variant observed distributed via malicious repositories using a ClickFix-style lure.
- UNC5342 cluster within Contagious Interview observed using EtherHiding - payloads and C2 pointers hidden in BNB Smart Chain and Ethereum smart contracts - the first documented nation-state use of blockchain-based dead-drop C2.
- BeaverTail and OtterCookie functionality merged into a modular OtterCookie v5 JavaScript suite with an integrated Socket.IO-based remote-shell module and AnyDesk installation.
- 197 malicious npm packages (31,000+ downloads) identified distributing an updated OtterCookie variant.
- Start of the primary WaterPlum attack window later cited in the IC3/joint law-enforcement advisory (December 2025-July 2026); StoatWaffle malware distribution via VS Code tasks.json auto-run abuse begins.
- StoatWaffle malware and its VS Code 'runOn: folderOpen' auto-run abuse technique publicly disclosed; Microsoft ships VS Code 1.109 defaulting task.allowAutomaticTasks to off.
- End of the primary WaterPlum attack window per IC3/joint advisory: 30,000+ devices infected across 100+ countries, 7,000+ cryptocurrency wallets compromised, roughly JPY 1.7 billion (~$10.71M) stolen.
- Japan (National Police Agency, National Cybersecurity Office), the US (FBI, Defense Department Cyber Crime Center), Australia (Signals Directorate/ACSC), and Germany (BND, BfV) jointly attribute the campaign to North Korea's 313 General Bureau, Munitions Industry Department; IC3 publishes advisory CSA-260918.
- GBHackers reports on the WaterPlum campaign and joint law-enforcement advisory, the hunt source for this threat record.
Sources cited for North Korean WaterPlum (Contagious Interview) Hackers Target
- North Korean WaterPlum Hackers Target IT Professionals
- IC3 Cyber Security Advisory CSA-260918: North Korean WaterPlum (Contagious Interview)
- North Korea's WaterPlum Hit 30,000 PCs Via Fake Job Offers
- North Korean Hackers Deploy BeaverTail Malware via 11 Malicious npm Packages
- North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware
- New wave of 'fake interviews' use 35 npm packages to spread malware
- North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware
- North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
- North Korean hackers use EtherHiding to hide malware on the blockchain
- North Korean 'WaterPlum,' commonly referred to as 'Contagious Interview,' cyber actor group targeting IT professionals
More in apt
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit
Detection coverage for TL-2026-2577
As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2577 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.