Threat reportAPTTL-2026-2577
North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
DPRK state-sponsored actor WaterPlum (aka Contagious Interview), operating under North Korea's 313 General Bureau, Munitions Industry Department, runs fake job-recruitment and AI face-swapped technical interviews against web developers, freelancers, and blockchain/cryptocurrency professionals to deploy BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware via trojanized npm packages and malicious VS Code projects.
Key facts for WageMole fake job interview
| Identifiers | TL-2026-2577 |
|---|---|
| Also known as | Contagious Interview, ClickFake Interview |
| Severity | HIGH |
| Exploitation status | Exploited in the wild |
| Affected products | Node.js Foundation / npm, Inc. npm registry / npm CLI; Microsoft Visual Studio Code |
| Weaknesses (CWE) | CWE-506 |
| Attribution | WageMole (high confidence) |
| Nation-state nexus | North Korea |
| Malware | BeaverTail - S1246, HexEval, InvisibleFerret - S1245, OtterCandy, OtterCookie, StoatWaffle, XORIndex |
| Tools | AnyDesk, socket.io-client |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1027 Obfuscated Files or Information, T1056 Input Capture, T1059 Command and Scripting Interpreter, T1071 Application Layer Protocol, T1082 System Information Discovery, T1113 Screen Capture, T1195 Supply Chain Compromise, T1204 User Execution, T1219 Remote Access Tools, T1497 Virtualization/Sandbox Evasion, T1552 Unsecured Credentials and 3 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | technology, financial services, cryptocurrency, blockchain web3 |
| Target regions | Global (100+ countries), japan, united states of america, australia, germany |
| Detection rules | 9 (1 shown free) |
| Sources | 11 cited sources |
Detection coverage for WageMole fake job interview
As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2577 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Non-Browser Process Reading Browser Credential Store or Cryptocurrency Wallet Extension Data
Detects node.exe/python.exe reading or copying Chrome/Edge 'Login Data', 'Local State', cookie databases, or cryptocurrency wallet browser-extension local storage (MetaMask, Phantom, and similar) — the credential and wallet-theft mechanism used by BeaverTail and InvisibleFerret against the 7,000+ compromised wallets in this campaign.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1555, T1552, T1005
- Data sources: sysmon, edr_file_telemetry, windows_security
- Severity: critical
- Confidence: high
Splunk SPL
index=sysmon OR index=edr sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval proc_lc=lower(Image), path_lc=lower(TargetFilename)
| where (proc_lc LIKE "%node.exe%" OR proc_lc LIKE "%python.exe%" OR proc_lc LIKE "%python3%")
| where match(path_lc, "login data|local state|cookies|nkbihfbeogaeaoehlefnkodbefgpgknn|bfnaelmomeimhlpmgjnjophhpkkoljpa|hnfanknocfeofbddgcijnmhnfnkdnaad")
| stats count values(TargetFilename) as files by ComputerName, User, Image
| table ComputerName, User, Image, files, count
| sort -countMicrosoft KQL
DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "python.exe", "python3.exe")
| where FolderPath has_any ("Login Data", "Local State", "Cookies") or FolderPath has_any ("nkbihfbeogaeaoehlefnkodbefgpgknn", "bfnaelmomeimhlpmgjnjophhpkkoljpa", "hnfanknocfeofbddgcijnmhnfnkdnaad")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ActionType
| sort by Timestamp descSigma
title: Node or Python Process Accessing Browser Credential Store or Crypto Wallet Extension Data
id: b6e2c1a4-8f3d-4a5e-9c71-2d6a8b4f0e11
status: experimental
description: Detects node.exe or python.exe reading browser credential databases or cryptocurrency wallet extension local storage, consistent with BeaverTail/InvisibleFerret theft of browser and wallet data.
references:
- https://thehackernews.com/2025/04/north-korean-hackers-deploy-beavertail.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
- attack.credential-access
- attack.t1555
- attack.t1552
- attack.collection
- attack.t1005
- attack.tool.beavertail
- attack.tool.invisibleferret
logsource:
category: file_event
product: windows
detection:
selection_proc:
Image|endswith:
- '\node.exe'
- '\python.exe'
- '\python3.exe'
selection_target:
TargetFilename|contains:
- 'Login Data'
- 'Local State'
- 'Cookies'
- 'nkbihfbeogaeaoehlefnkodbefgpgknn'
- 'bfnaelmomeimhlpmgjnjophhpkkoljpa'
condition: selection_proc and selection_target
falsepositives:
- Enterprise password-manager sync agents or approved backup software reading the same browser profile paths
level: criticalKnown false positives:
- Enterprise password-manager sync agents or approved backup/EDR software reading the same browser profile paths
Tuning notes: Allowlist signed, known-good password-manager and backup processes by hash; alert with highest priority when the reading process is node.exe/python.exe spawned outside an IDE-approved working directory.
- VS Code tasks.json runOn:folderOpen Auto-Executing Node.js Process (StoatWaffle) · unlock with TL Creds
- Keylogging, Screen-Capture, and Chained Host-Fingerprinting Behavior Following Interview Package Execution · unlock with TL Creds
- Developer Endpoint Polling Blockchain RPC Endpoints Consistent with EtherHiding Dead-Drop C2 · unlock with TL Creds
- Node.js Process Executing Obfuscated eval()-Based Loader Payload (HexEval/XORIndex) · unlock with TL Creds
- Node Process Accessing macOS iCloud Keychain or Browser Credential Files (StoatWaffle) · unlock with TL Creds
- Developer Process Fetching Next-Stage Payload from Vercel App or Raw GitHub Gist · unlock with TL Creds
- npm Postinstall Hook Spawning Shell or Node Child Process on Developer Endpoint · unlock with TL Creds
- Silent AnyDesk Installation Followed by Persistent Outbound Beacon from Node-Spawned Process · unlock with TL Creds
Indicators of compromise for WageMole fake job interview
As of 2026-09-19, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-2577.
How WageMole fake job interview works
Between December 2025 and July 2026 the campaign compromised 30,000+ devices across 100+ countries and 7,000+ cryptocurrency wallets, stealing roughly JPY 1.7 billion (~$10.71M); it was formally attributed on 2026-09-18 by a joint Japan-US-Australia-Germany law-enforcement advisory.
WaterPlum, publicly tracked as "Contagious Interview" (and overlapping with the related "ClickFake Interview" campaign and the Google/Mandiant-tracked cluster UNC5342), is a North Korean state-sponsored threat actor linked to DPRK IT-worker laptop-farm operations. The group poses as recruiters for AI, cryptocurrency, and NFT companies on LinkedIn, job boards, and freelance marketplaces, luring web developers, blockchain specialists, and cryptocurrency professionals into a fake technical interview or coding assessment. Victims are told to download and run "test" code hosted on GitHub, Bitbucket, or delivered via Google Docs assignments; during video calls, operators use AI face-swapping and disable video feeds citing connectivity issues to mask a single operator running many fabricated identities.
The malicious code is distributed chiefly through the npm software supply chain: typosquatted and postinstall-hook-laden packages (e.g., react-plaid-sdk, reactbootstraps, vite-plugin-next-refresh, node-orm-mongoose) and compromises of legitimate packages (rand-user-agent) deliver a layered malware stack. BeaverTail, a JavaScript infostealer/loader active since at least 2022, harvests browser data and cryptocurrency-wallet extensions and stages the cross-platform Python backdoor InvisibleFerret for remote control, keylogging, and file theft. OtterCookie, most recently merged with BeaverTail into a modular "OtterCookie v5" JS suite, adds a remote-shell module (via the socket.io-client npm package) and installs AnyDesk for persistent remote-hands-on-keyboard access. OtterCandy, a hybrid of OtterCookie and the RATatouille RAT first spread via the May 2025 rand-user-agent compromise, adds anti-forensic capability and has been active since July 2025. StoatWaffle, distributed since December 2025, abuses Visual Studio Code's tasks.json "runOn: folderOpen" auto-run feature to execute Node.js code the moment a malicious blockchain-themed repository is opened, then steals browser and macOS iCloud Keychain credentials via stealer and RAT modules; Microsoft mitigated the underlying auto-run behavior in VS Code 1.109/1.110. Loader families HexEval and XORIndex (the latter spread via 67 packages with 17,000+ downloads) fingerprint hosts and pull further payloads via eval(). Since October 2025, related infrastructure (UNC5342) has used "EtherHiding" — storing encrypted payload/C2 pointers inside BNB Smart Chain and Ethereum smart contracts — as a nation-state-first blockchain dead-drop-resolver C2 technique.
Exfiltrated data spans browser-stored credentials and cookies, clipboard contents, keystrokes, screenshots, cryptocurrency private keys and seed phrases, identity documents, and source code. On 2026-09-18, Japan's National Police Agency and National Cybersecurity Office, the US FBI and Defense Department Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND/BfV jointly attributed the campaign to North Korea's 313 General Bureau, Munitions Industry Department, and published a coordinated advisory (IC3 CSA-260918) alongside recommended mitigations for developers and organizations.
MITRE ATT&CK techniques by tactic:
Collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1219 Remote Access Tools
Discovery
T1082 System Information Discovery
Initial Access
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Resource Development
Remediation for WageMole fake job interview
Patches
- Visual Studio Code 1.109 (task.allowAutomaticTasks defaults to off)
- Visual Studio Code 1.110 (adds a workspace-open warning for auto-run tasks; workspace-level settings can no longer silently override the default)
Immediate actions
- Run any untrusted interview/coding-test code only inside an isolated VM, container, or disposable sandbox, never on a primary or corporate workstation
- Treat any interview task or 'debug this' request that runs curl, base64, -enc, mshta, or Invoke-WebRequest as malicious and halt the process
- Open unfamiliar GitHub/Bitbucket repositories in VS Code with Workspace Trust / Restricted Mode enabled and inspect .vscode/tasks.json before opening a folder
- Update Visual Studio Code to 1.110 or later so auto-run tasks are disabled by default and a workspace-open warning is shown
- Audit developer and CI/CD environments for the identified malicious/typosquatted npm packages and remove them
- Rotate browser-stored credentials and move cryptocurrency held in any wallet accessed on a machine used for an unsolicited technical interview to a new wallet
Workarounds
- On VS Code versions prior to 1.109, manually set task.allowAutomaticTasks to off in user settings
- Disable npm postinstall script execution when evaluating unknown packages (npm install --ignore-scripts)
Longer-term hardening
- Deploy EDR with behavioral detection tuned to Node.js/Python child processes spawned from IDEs, unexpected AnyDesk installs, and browser credential-store access
- Enforce npm package allowlisting or a private-registry proxy with provenance/postinstall-script controls (npm config set ignore-scripts true) on developer endpoints
- Provide security-awareness training to developers, freelancers, and recruiting teams on fake-recruiter and technical-interview social engineering, including AI face-swap red flags
- Monitor developer-workstation egress to Vercel apps, raw GitHub Gist content, and blockchain RPC endpoints (BNB Smart Chain/Ethereum) for anomalous polling consistent with EtherHiding C2
Affected and fixed versions
- Node.js Foundation / npm, Inc. — npm registry / npm CLI
Vulnerable versions: N/A - abuse of package publishing and postinstall hooks as a distribution vector, not a code vulnerability
Fixed in: N/A - mitigated by package removal, provenance checks, and ignore-scripts policy, not a patch - Microsoft — Visual Studio Code
Vulnerable versions: < 1.109 (task.allowAutomaticTasks enabled by default, allowing runOn: folderOpen auto-execution)
Fixed in: 1.109 (auto-run tasks default off); 1.110 (adds workspace-open auto-run warning prompt)
Timeline of WageMole fake job interview
- locked-ioc-14 JavaScript infostealer first observed active; later becomes the primary first-stage payload for the Contagious Interview/WaterPlum campaign.
- Eleven malicious npm packages found deploying locked-ioc-14 to developer machines (The Hacker News).
- Legitimate npm package locked-ioc-8 compromised in a supply-chain attack, distributing the RATatouille RAT that later merges into locked-ioc-15.
- locked-ioc-15 (locked-ioc-11 + RATatouille hybrid, with an anti-forensic module) first deployed in Contagious Interview operations, and later also in the related ClickFake Interview campaign.
- New locked-ioc-14 variant observed distributed via malicious repositories using a ClickFix-style lure.
- locked-ioc-22 cluster within Contagious Interview observed using EtherHiding - payloads and C2 pointers hidden in locked-ioc-7 and locked-ioc-18 smart contracts - the first documented nation-state use of blockchain-based dead-drop C2.
- locked-ioc-14 and locked-ioc-11 functionality merged into a modular locked-ioc-11 v5 JavaScript suite with an integrated Socket.IO-based remote-shell module and locked-ioc-21 installation.
- 197 malicious npm packages (31,000+ downloads) identified distributing an updated locked-ioc-11 variant.
- Start of the primary WaterPlum attack window later cited in the IC3/joint law-enforcement advisory (December 2025-July 2026); locked-ioc-12 malware distribution via VS Code tasks.json auto-run abuse begins.
- locked-ioc-12 malware and its VS Code 'runOn: folderOpen' auto-run abuse technique publicly disclosed; Microsoft ships VS Code 1.109 defaulting task.allowAutomaticTasks to off.
- End of the primary WaterPlum attack window per IC3/joint advisory: 30,000+ devices infected across 100+ countries, 7,000+ cryptocurrency wallets compromised, roughly JPY 1.7 billion (~$10.71M) stolen.
- Japan (National Police Agency, National Cybersecurity Office), the US (FBI, Defense Department Cyber Crime Center), Australia (Signals Directorate/ACSC), and Germany (BND, BfV) jointly attribute the campaign to North Korea's locked-ioc-1; IC3 publishes advisory CSA-260918.
- GBHackers reports on the WaterPlum campaign and joint law-enforcement advisory, the hunt source for this threat record.
Sources cited for WageMole fake job interview
- IC3 Cyber Security Advisory CSA-260918: North Korean WaterPlum (Contagious Interview) ic3.gov · Advisory · 2026-09-18
- North Korean 'WaterPlum,' commonly referred to as 'Contagious Interview,' cyber actor group targeting IT professionals cyber.gov.au · Advisory · 2026-09-18
- North Korean WaterPlum Hackers Target IT Professionals gbhackers.com · News · 2026-09-19
- North Korea's WaterPlum Hit 30,000 PCs Via Fake Job Offers thecyberexpress.com · News · 2026-09-18
- North Korean Hackers Deploy BeaverTail Malware via 11 Malicious npm Packages The Hacker News · News · 2025-04-01
- North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware The Hacker News · News · 2025-10-01
- New wave of 'fake interviews' use 35 npm packages to spread malware BleepingComputer · News · 2025-09-01
- North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware The Hacker News · News · 2026-03-23
- North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware The Hacker News · News · 2025-11-01
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts The Hacker News · News · 2025-10-01
- North Korean hackers use EtherHiding to hide malware on the blockchain BleepingComputer · News · 2025-10-01
More from WageMole
- Famous Chollima (North Korea) APT: Contagious Interview Campaigns, BeaverTail/OtterCookie/InvisibleFerret Malware and Fake IT Worker Operations
- Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret Infostealer Campaign
- North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue from 70+ U.S. Companies
- ChainDrop npm Worm and PolinRider DPRK-Linked Operation Use Blockchain C2 to Steal Cloud and CI/CD Credentials
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
- Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script Detection
Previous and next in apt
Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated —.
