# North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware

> DPRK state-sponsored actor WaterPlum (aka Contagious Interview), operating under North Korea's 313 General Bureau, Munitions Industry Department, runs fake job-recruitment and AI face-swapped technical interviews against web developers, freelancers, and blockchain/cryptocurrency professionals to deploy BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware via trojanized npm packages and malicious VS Code projects. Between December 2025 and July 2026 the campaign compromised 30,000+ devices across 100+ countries and 7,000+ cryptocurrency wallets, stealing roughly JPY 1.7 billion (~$10.71M); it was formally attributed on 2026-09-18 by a joint Japan-US-Australia-Germany law-enforcement advisory.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2577
- **ID:** TL-2026-2577
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WaterPlum, publicly tracked as "Contagious Interview" (and overlapping with the related "ClickFake Interview" campaign and the Google/Mandiant-tracked cluster UNC5342), is a North Korean state-sponsored threat actor linked to DPRK IT-worker laptop-farm operations. The group poses as recruiters for AI, cryptocurrency, and NFT companies on LinkedIn, job boards, and freelance marketplaces, luring web developers, blockchain specialists, and cryptocurrency professionals into a fake technical interview or coding assessment. Victims are told to download and run "test" code hosted on GitHub, Bitbucket, or delivered via Google Docs assignments; during video calls, operators use AI face-swapping and disable video feeds citing connectivity issues to mask a single operator running many fabricated identities.

The malicious code is distributed chiefly through the npm software supply chain: typosquatted and postinstall-hook-laden packages (e.g., react-plaid-sdk, reactbootstraps, vite-plugin-next-refresh, node-orm-mongoose) and compromises of legitimate packages (rand-user-agent) deliver a layered malware stack. BeaverTail, a JavaScript infostealer/loader active since at least 2022, harvests browser data and cryptocurrency-wallet extensions and stages the cross-platform Python backdoor InvisibleFerret for remote control, keylogging, and file theft. OtterCookie, most recently merged with BeaverTail into a modular "OtterCookie v5" JS suite, adds a remote-shell module (via the socket.io-client npm package) and installs AnyDesk for persistent remote-hands-on-keyboard access. OtterCandy, a hybrid of OtterCookie and the RATatouille RAT first spread via the May 2025 rand-user-agent compromise, adds anti-forensic capability and has been active since July 2025. StoatWaffle, distributed since December 2025, abuses Visual Studio Code's tasks.json "runOn: folderOpen" auto-run feature to execute Node.js code the moment a malicious blockchain-themed repository is opened, then steals browser and macOS iCloud Keychain credentials via stealer and RAT modules; Microsoft mitigated the underlying auto-run behavior in VS Code 1.109/1.110. Loader families HexEval and XORIndex (the latter spread via 67 packages with 17,000+ downloads) fingerprint hosts and pull further payloads via eval(). Since October 2025, related infrastructure (UNC5342) has used "EtherHiding" — storing encrypted payload/C2 pointers inside BNB Smart Chain and Ethereum smart contracts — as a nation-state-first blockchain dead-drop-resolver C2 technique.

Exfiltrated data spans browser-stored credentials and cookies, clipboard contents, keystrokes, screenshots, cryptocurrency private keys and seed phrases, identity documents, and source code. On 2026-09-18, Japan's National Police Agency and National Cybersecurity Office, the US FBI and Defense Department Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND/BfV jointly attributed the campaign to North Korea's 313 General Bureau, Munitions Industry Department, and published a coordinated advisory (IC3 CSA-260918) alongside recommended mitigations for developers and organizations.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1082 System Information Discovery
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1113 Screen Capture
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1071 Application Layer Protocol

## Sources

- [North Korean WaterPlum Hackers Target IT Professionals](https://gbhackers.com/north-korean-waterplum-hackers-target-it-professionals/)
- [IC3 Cyber Security Advisory CSA-260918: North Korean WaterPlum (Contagious Interview)](https://www.ic3.gov/CSA/2026/260918.pdf)
- [North Korea's WaterPlum Hit 30,000 PCs Via Fake Job Offers](https://thecyberexpress.com/waterplum-contagious-interview-north-korea/)
- [North Korean Hackers Deploy BeaverTail Malware via 11 Malicious npm Packages](https://thehackernews.com/2025/04/north-korean-hackers-deploy-beavertail.html)
- [North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware](https://thehackernews.com/2025/10/north-korean-hackers-combine-beavertail.html)
- [New wave of 'fake interviews' use 35 npm packages to spread malware](https://www.bleepingcomputer.com/news/security/new-wave-of-fake-interviews-use-35-npm-packages-to-spread-malware/)
- [North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware](https://thehackernews.com/2026/03/north-korean-hackers-abuse-vs-code-auto.html)
- [North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware](https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html)
- [North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts](https://thehackernews.com/2025/10/north-korean-hackers-use-etherhiding-to.html)
- [North Korean hackers use EtherHiding to hide malware on the blockchain](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-etherhiding-to-hide-malware-on-the-blockchain/)
- [North Korean 'WaterPlum,' commonly referred to as 'Contagious Interview,' cyber actor group targeting IT professionals](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/north-korean-waterplum-commonly-referred-to-as-contagious-interview-cyber-actor-group-targeting-it-professionals)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2577