North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
North Korean WaterPlum (Contagious Interview) Campaign (TL-2026-2581), also tracked as Contagious Interview, is a high-severity advanced persistent threat campaign, first published 2026-09-19. It is attributed to WageMole (North Korea) with high confidence, affects npm, Inc. / OpenJS Foundation npm public package registry, maps to 16 MITRE ATT&CK techniques (T1027, T1036.005, T1056.001), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2581
- Threat ID
- TL-2026-2581
- Also known as
- Contagious Interview
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-09-19
- Last reviewed
- 2026-09-19
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, financial services, artificial intelligence, freelance gig economy
- Target regions
- Global, japan, united states of america, australia, germany, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in North Korean WaterPlum (Contagious Interview) Campaign
Malware and tooling: BeaverTail - S1246, FlexibleFerret, InvisibleFerret - S1245, OtterCandy, OtterCookie, StoatWaffle, AnyDesk
A joint advisory from Japan's NPA, US FBI/IC3, Australia's ASD Cyber Security Centre, and Germany's BND/BfV attributes North Korea's 313 General Bureau-linked WaterPlum group (the actor behind the long-running 'Contagious Interview' campaign) to infecting at least 30,000 devices across 100+ countries between December 2025 and July 2026. The group used fake recruiter outreach, sham job interviews/coding tests, and malicious npm/PyPI/Go/Rust/Packagist packages plus trojanized VS Code projects to deploy the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware families, compromising over 7,000 cryptocurrency wallets and moving $10.71 million (1.7 billion JPY) to North Korea.
How North Korean WaterPlum (Contagious Interview) Campaign works
WaterPlum — publicly tracked interchangeably as Contagious Interview, Famous Chollima, DeceptiveDevelopment, CL-STA-0240, UNC5342, PurpleBravo, Void Dokkaebi, WageMole, Nickel Tapestry, Storm-1877, and Gwisin Gang — is a North Korean cyber-enabled financial crime operation that a September 18, 2026 joint advisory (Japan NPA/National Cybersecurity Office, US FBI and DoD Cyber Crime Center, Australia's ASD Cyber Security Centre, and Germany's BND/BfV) formally ties to the 313 General Bureau of the Munitions Industry Department under North Korea's Workers' Party Central Committee — the same command structure the advisory links to North Korea's fraudulent overseas IT-worker ('laptop farm') schemes.
The operation runs a two-track model: (1) DPRK operatives are hired as freelance/remote developers on crowdsourcing and gig platforms using stolen or fabricated identities, laptop farms (a domestic 'enabler' hosts a company-issued or locally purchased laptop while a remote DPRK-based operator controls it over VPN chains such as Astrill VPN, NETNUT Proxy, and High Speed Rabbit Proxy), earning legitimate wages that evade sanctions; and (2) the same actor set runs 'Contagious Interview,' posing as recruiters for fictitious or impersonated AI, cryptocurrency, and NFT companies to lure real software developers, web freelancers, and blockchain specialists via social media, job boards, gig-work platforms, and freelance marketplaces. Victims are walked through a fake virtual technical interview or coding assignment — sometimes with the interviewer using AI face-swapping software before disconnecting the video feed — and are told to clone and run a code repository or npm/PyPI/Go/Rust package hosted on GitHub, GitLab, or Bitbucket to complete the 'test.'
The payloads escalate across five named malware families sharing infrastructure and code lineage: BeaverTail (a heavily obfuscated JavaScript infostealer/loader embedded in npm packages, historically the first stage that fetches InvisibleFerret), InvisibleFerret (a Python-based multi-stage backdoor for reconnaissance, remote command execution, and further payload staging), OtterCookie (a JavaScript RAT/infostealer first seen in the wild in September 2024, whose October 2025 'v5' variant merged BeaverTail characteristics per Cisco Talos and added VM/sandbox-detection and heavier obfuscation), OtterCandy (an OtterCookie-RAT hybrid), and StoatWaffle (modular Node.js malware delivered through malicious VS Code projects whose .vscode/tasks.json or postinstall hooks execute automatically once a workspace is trusted). A related loader family, FlexibleFerret, persists via Windows Registry Run keys and supports encrypted HTTP/TCP C2 with dynamic plugin loading.
Distribution is a cross-ecosystem software-supply-chain operation: Socket and other researchers have tracked more than 1,700 malicious packages tied to the broader campaign since January 2025, spanning npm, PyPI, Go modules, Rust crates, and Packagist/PHP, with names disguised as mundane logging/licensing utilities (e.g., dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz on npm; logutilkit, apachelicense, fluxhttp, license-utils-kit on PyPI; formstash and mit-license-pkg as Go modules; logtrace as a Rust crate; logkit on Packagist) so the malicious code sits inside functions that match the package's advertised purpose rather than firing on install. Earlier-stage droppers observed in the same cluster (node-nvm-ssh, published and pulled from npm in August 2025) used postinstall hooks, while legitimate npm dependencies such as node-global-key-listener, screenshot-desktop, and socket.io-client were repurposed inside the malware for keylogging, screen capture, and Socket.IO-based C2 respectively. Staging infrastructure has leaned on abused legitimate web services — Vercel-hosted (vercel.app) pages and the short.gy URL shortener — to host or redirect to payloads.
Once executed, the malware harvests browser-stored credentials and cookies, monitors the clipboard and keystrokes, captures screenshots, enumerates and drains cryptocurrency wallet private keys and seed phrases, scrapes KeePass/1Password credential stores and .env files, and exfiltrates identity documents (used downstream for further impersonation), while installing AnyDesk for hands-on-keyboard remote access. The September 2026 advisory quantifies the resulting damage at 30,000+ infected devices in 100+ countries, 7,000+ compromised cryptocurrency wallets, and $10.71 million (1.7 billion JPY) transferred to North Korea between December 2025 and July 2026 — continuing activity documented as far back as December 2022 under the Contagious Interview name, and as recently as a July 2026 108-package/extension 'PolinRider' wave publicized after the advisory's coverage window closed.
MITRE ATT&CK techniques used in TL-2026-2581
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497 Virtualization/Sandbox Evasion
Collection
T1056.001 Keylogging; T1113 Screen Capture
Execution
T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1566.003 Spearphishing via Service
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1552.001 Credentials In Files; T1555 Credentials from Password Stores
Resource Development
Affected products and versions in North Korean WaterPlum (Contagious Interview) Campaign
- npm, Inc. / OpenJS Foundation — npm public package registry
Vulnerable versions: N/A — malicious first-party package uploads (e.g. dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz, node-nvm-ssh), not a registry software vulnerability
Fixed in: N/A - Python Software Foundation — PyPI public package registry
Vulnerable versions: N/A — malicious first-party package uploads (e.g. logutilkit, apachelicense, fluxhttp, license-utils-kit)
Fixed in: N/A - Open Source / crates.io, pkg.go.dev, Packagist — Go module, Rust crate, and Packagist/PHP registries
Vulnerable versions: N/A — malicious packages (e.g. github.com/golangorg/formstash, github.com/aokisasakidev/mit-license-pkg, logtrace crate, golangorg/logkit)
Fixed in: N/A - Microsoft — Visual Studio Code
Vulnerable versions: N/A — workspace-trust / .vscode/tasks.json auto-execution abused via social engineering, not a VS Code product vulnerability
Fixed in: N/A
Remediation for North Korean WaterPlum (Contagious Interview) Campaign
Immediate actions
- Treat unsolicited recruiter contact via social media, job boards, gig-work sites, or freelance marketplaces that asks for a coding test or repository clone as a likely social-engineering lure
- Never execute unverified interview/coding-test code, npm/PyPI/Go/Rust/Composer packages, or cloned repositories on primary developer workstations or any device with stored credentials or crypto wallets
- Open unfamiliar Visual Studio Code workspaces in Restricted Mode and inspect .vscode/tasks.json and package.json pre/postinstall hooks before trusting the workspace
- Isolate any device known to have run an interview/coding-test artifact, then rotate all browser-stored credentials, password-manager (KeePass/1Password) contents, and cryptocurrency wallet seed phrases accessible from it
Workarounds
- Require multi-person review and sign-off before any employee or contractor executes third-party code obtained through a job-interview process
- Monitor and restrict outbound traffic from developer endpoint segments to disposable hosting/shortener services such as Vercel-hosted staging pages and short.gy links
Longer-term hardening
- Isolate coding-test and interview environments in non-persistent virtual machines separate from production credentials and wallets
- Enforce application control/allow-listing to restrict unmanaged Node.js, Python, and PowerShell execution on developer endpoints
- Deploy EDR tuned to flag code-editor-to-shell-to-network execution chains, unexpected AnyDesk installs, and Registry Run-key persistence
- Require dependency provenance/lockfile review before installing npm, PyPI, Go, Rust, or Composer packages introduced via an unsolicited job or interview process
- Move developer secrets out of .env files and into just-in-time credential vaults
Timeline of North Korean WaterPlum (Contagious Interview) Campaign
- Contagious Interview activity (fake job-interview lures delivering BeaverTail/InvisibleFerret) first documented in the wild.
- OtterCookie, a JavaScript RAT/infostealer complementary to BeaverTail, is first observed in real-world Contagious Interview attacks.
- The malicious npm package node-nvm-ssh, using a postinstall hook to stage the infection chain, is published to the npm registry.
- node-nvm-ssh is removed from the npm registry after detection.
- Cisco Talos reports OtterCookie 'v5' has merged characteristics of BeaverTail, blurring the line between the two malware families and adding heavier obfuscation and VM-detection.
- Start of the infection window later quantified by the September 2026 joint advisory (30,000+ devices, 100+ countries).
- Microsoft publishes a detailed technical writeup on the Contagious Interview campaign, mapping TTPs including FlexibleFerret's Registry Run-key persistence.
- Researchers report over 1,700 malicious packages tied to the campaign spread across npm, PyPI, Go, and Rust ecosystems since January 2025.
- End of the infection window covered by the joint advisory; a related 108-package/extension 'PolinRider' wave is separately reported around this period.
- Japan's NPA/National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's ASD Cyber Security Centre, and Germany's BND/BfV jointly publish an advisory attributing WaterPlum/Contagious Interview to North Korea's 313 General Bureau and quantifying $10.71M (1.7B JPY) in crypto theft from 7,000+ wallets across 30,000+ infected devices.
- BleepingComputer and other outlets report on the joint advisory's findings.
Sources cited for North Korean WaterPlum (Contagious Interview) Campaign
- North Korean WaterPlum hackers infected 30,000 devices worldwide
- Joint Cybersecurity Advisory: North Korean "WaterPlum" (Contagious Interview) Cyber Actor Group Targeting IT Professionals
- North Korean "WaterPlum," commonly referred to as "Contagious Interview," cyber actor group targeting IT professionals
- North Korean WaterPlum Hackers Infect 30,000 Devices via Fake Job Interviews to Steal Crypto
- WaterPlum: North Korean Campaign Infects 30,000 Devices via Fake Interview Tasks
- North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto
- How a laptop farm works: advisory issued by Japan against North Korean group WaterPlum
- North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware
- BeaverTail (Malware Family)
- N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust
- Contagious Interview: Malware delivered through fake developer job interviews
More in apt
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
- North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit
Detection coverage for TL-2026-2581
As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2581 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.