North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages

Key facts for WaterPlum crypto theft campaign

Detection coverage for WaterPlum crypto theft campaign

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2581 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BeaverTail/InvisibleFerret/OtterCookie Credential Store, Crypto Wallet, and .env Harvesting with Keylogging/Screen Capture

Detects a Node.js or Python process (consistent with BeaverTail, InvisibleFerret, OtterCookie/OtterCandy, or StoatWaffle) accessing browser credential stores, KeePass/1Password vault files, .env files, or cryptocurrency wallet files (wallet.dat, Electrum, MetaMask/Exodus leveldb stores), combined with loading of repurposed legitimate npm dependencies (node-global-key-listener for keylogging, screenshot-desktop for screen capture) — post-exploitation collection consistent with the campaign's 7,000+ drained crypto wallets.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555, T1552.001, T1056.001, T1113, T1082
• Data sources: sysmon, windows_security, edr_file_telemetry, browser_credential_store
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon OR index=edr (EventCode=11 OR EventCode=1)
| eval img_lc=lower(Image), tgt_lc=lower(TargetFilename), cl_lc=lower(CommandLine)
| where match(img_lc, "(node\.exe|python(3)?\.exe)$")
| eval sensitive_target=if(match(tgt_lc, "(login data|local state|cookies|\.kdbx|1password|\.env$|wallet\.dat|electrum|metamask|exodus|leveldb)"), 1, 0)
| eval capture_module=if(match(cl_lc, "(node-global-key-listener|screenshot-desktop|clipboardy|robotjs)"), 1, 0)
| where sensitive_target=1 OR capture_module=1
| table _time, ComputerName, User, Image, TargetFilename, CommandLine, sensitive_target, capture_module
| sort -_time

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe","python.exe","python3.exe")
| where FileName has_any ("Login Data","Local State","Cookies",".kdbx","1password",".env","wallet.dat","electrum","metamask","exodus","leveldb")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName in~ ("node.exe")
    | where ProcessCommandLine has_any ("node-global-key-listener","screenshot-desktop","clipboardy","robotjs")
    | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName=ProcessCommandLine, FolderPath=""
)
| order by Timestamp desc

Sigma

title: Node.js/Python Process Accessing Credential Stores, Crypto Wallets, or .env with Keylog/Screen-Capture Modules (WaterPlum Collection)
id: 4a9d1e6c-8f22-4b7a-b3d5-9e6c1f0a2b77
status: experimental
description: Detects file access to browser credential stores, password-manager vaults, .env files, and cryptocurrency wallet files by node.exe/python.exe, alongside repurposed keylogging/screenshot npm modules — consistent with BeaverTail/InvisibleFerret/OtterCookie post-exploitation collection in the WaterPlum/Contagious Interview campaign.
references:
  - https://www.ic3.gov/CSA/2026/260918.pdf
  - https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
  - attack.credential-access
  - attack.collection
  - attack.discovery
  - attack.t1555
  - attack.t1552.001
  - attack.t1056.001
  - attack.t1113
  - attack.t1082
  - attack.malware.beavertail
  - attack.malware.invisibleferret
  - attack.malware.ottercookie
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
  selection_target:
    TargetFilename|contains:
      - 'Login Data'
      - 'Local State'
      - 'Cookies'
      - '.kdbx'
      - '1Password'
      - '.env'
      - 'wallet.dat'
      - 'electrum'
      - 'metamask'
      - 'exodus'
      - 'leveldb'
  condition: selection_process and selection_target
falsepositives:
  - Legitimate password-manager sync clients or backup tools accessing the same vault paths
  - Developer tooling that legitimately reads .env files for local configuration
level: high

Known false positives:

• Legitimate password-manager sync clients or backup tools accessing the same vault paths
• Developer tooling that legitimately reads .env files for local configuration

Tuning notes: Baseline which developer tools legitimately touch .env/wallet paths (e.g. dotenv-vault clients, hardware-wallet bridges) and exclude their signed binaries by hash; correlate with TL-2026-2581-SPL-001 firing on the same host within 24h to prioritize triage, since standalone file access alone has moderate false-positive volume.

• 🔒 WaterPlum Malicious npm/PyPI/Go/Rust Package Install with Postinstall Hook or VS Code Workspace Auto-Exec · unlock with TL Creds
• 🔒 BeaverTail/InvisibleFerret/OtterCookie Credential Store, Crypto Wallet, and .env Harvesting with Keylogging/Screen Capture · unlock with TL Creds
• 🔒 FlexibleFerret Registry Run-Key Persistence with Encrypted C2 Beaconing, AnyDesk Install, and Clipboard/Exfil Activity · unlock with TL Creds
• 🔒 WaterPlum Malicious npm/PyPI/Go/Rust Package Install with Postinstall Hook or VS Code Workspace Auto-Exec · unlock with TL Creds
• 🔒 BeaverTail/InvisibleFerret/OtterCookie Credential Store, Crypto Wallet, and .env Harvesting with Keylogging/Screen Capture · unlock with TL Creds
• 🔒 FlexibleFerret Registry Run-Key Persistence with Encrypted C2 Beaconing, AnyDesk Install, and Clipboard/Exfil Activity · unlock with TL Creds
• 🔒 WaterPlum Malicious npm/PyPI/Go/Rust Package Install with Postinstall Hook or VS Code Workspace Auto-Exec · unlock with TL Creds
• 🔒 FlexibleFerret Registry Run-Key Persistence with Encrypted C2 Beaconing, AnyDesk Install, and Clipboard/Exfil Activity · unlock with TL Creds

Indicators of compromise for WaterPlum crypto theft campaign

As of 2026-09-19, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2581.

How WaterPlum crypto theft campaign works

The group used fake recruiter outreach, sham job interviews/coding tests, and malicious npm/PyPI/Go/Rust/Packagist packages plus trojanized VS Code projects to deploy the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware families, compromising over 7,000 cryptocurrency wallets and moving $10.71 million (1.7 billion JPY) to North Korea.

WaterPlum — publicly tracked interchangeably as Contagious Interview, Famous Chollima, DeceptiveDevelopment, CL-STA-0240, UNC5342, PurpleBravo, Void Dokkaebi, WageMole, Nickel Tapestry, Storm-1877, and Gwisin Gang — is a North Korean cyber-enabled financial crime operation that a September 18, 2026 joint advisory (Japan NPA/National Cybersecurity Office, US FBI and DoD Cyber Crime Center, Australia's ASD Cyber Security Centre, and Germany's BND/BfV) formally ties to the 313 General Bureau of the Munitions Industry Department under North Korea's Workers' Party Central Committee — the same command structure the advisory links to North Korea's fraudulent overseas IT-worker ('laptop farm') schemes.

The operation runs a two-track model: (1) DPRK operatives are hired as freelance/remote developers on crowdsourcing and gig platforms using stolen or fabricated identities, laptop farms (a domestic 'enabler' hosts a company-issued or locally purchased laptop while a remote DPRK-based operator controls it over VPN chains such as Astrill VPN, NETNUT Proxy, and High Speed Rabbit Proxy), earning legitimate wages that evade sanctions; and (2) the same actor set runs 'Contagious Interview,' posing as recruiters for fictitious or impersonated AI, cryptocurrency, and NFT companies to lure real software developers, web freelancers, and blockchain specialists via social media, job boards, gig-work platforms, and freelance marketplaces. Victims are walked through a fake virtual technical interview or coding assignment — sometimes with the interviewer using AI face-swapping software before disconnecting the video feed — and are told to clone and run a code repository or npm/PyPI/Go/Rust package hosted on GitHub, GitLab, or Bitbucket to complete the 'test.'

The payloads escalate across five named malware families sharing infrastructure and code lineage: BeaverTail (a heavily obfuscated JavaScript infostealer/loader embedded in npm packages, historically the first stage that fetches InvisibleFerret), InvisibleFerret (a Python-based multi-stage backdoor for reconnaissance, remote command execution, and further payload staging), OtterCookie (a JavaScript RAT/infostealer first seen in the wild in September 2024, whose October 2025 'v5' variant merged BeaverTail characteristics per Cisco Talos and added VM/sandbox-detection and heavier obfuscation), OtterCandy (an OtterCookie-RAT hybrid), and StoatWaffle (modular Node.js malware delivered through malicious VS Code projects whose .vscode/tasks.json or postinstall hooks execute automatically once a workspace is trusted). A related loader family, FlexibleFerret, persists via Windows Registry Run keys and supports encrypted HTTP/TCP C2 with dynamic plugin loading.

Distribution is a cross-ecosystem software-supply-chain operation: Socket and other researchers have tracked more than 1,700 malicious packages tied to the broader campaign since January 2025, spanning npm, PyPI, Go modules, Rust crates, and Packagist/PHP, with names disguised as mundane logging/licensing utilities (e.g., dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz on npm; logutilkit, apachelicense, fluxhttp, license-utils-kit on PyPI; formstash and mit-license-pkg as Go modules; logtrace as a Rust crate; logkit on Packagist) so the malicious code sits inside functions that match the package's advertised purpose rather than firing on install. Earlier-stage droppers observed in the same cluster (node-nvm-ssh, published and pulled from npm in August 2025) used postinstall hooks, while legitimate npm dependencies such as node-global-key-listener, screenshot-desktop, and socket.io-client were repurposed inside the malware for keylogging, screen capture, and Socket.IO-based C2 respectively. Staging infrastructure has leaned on abused legitimate web services — Vercel-hosted (vercel.app) pages and the short.gy URL shortener — to host or redirect to payloads.

Once executed, the malware harvests browser-stored credentials and cookies, monitors the clipboard and keystrokes, captures screenshots, enumerates and drains cryptocurrency wallet private keys and seed phrases, scrapes KeePass/1Password credential stores and .env files, and exfiltrates identity documents (used downstream for further impersonation), while installing AnyDesk for hands-on-keyboard remote access. The September 2026 advisory quantifies the resulting damage at 30,000+ infected devices in 100+ countries, 7,000+ compromised cryptocurrency wallets, and $10.71 million (1.7 billion JPY) transferred to North Korea between December 2025 and July 2026 — continuing activity documented as far back as December 2022 under the Contagious Interview name, and as recently as a July 2026 108-package/extension 'PolinRider' wave publicized after the advisory's coverage window closed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497 Virtualization/Sandbox Evasion

Collection

T1056.001 Keylogging; T1113 Screen Capture

Execution

T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File

Discovery

T1082 System Information Discovery

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools; T1566.003 Spearphishing via Service

Persistence

T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1552.001 Credentials In Files; T1555 Credentials from Password Stores

Resource Development

T1583.006 Web Services; T1585.001 Social Media Accounts

Remediation for WaterPlum crypto theft campaign

Immediate actions

• Treat unsolicited recruiter contact via social media, job boards, gig-work sites, or freelance marketplaces that asks for a coding test or repository clone as a likely social-engineering lure
• Never execute unverified interview/coding-test code, npm/PyPI/Go/Rust/Composer packages, or cloned repositories on primary developer workstations or any device with stored credentials or crypto wallets
• Open unfamiliar Visual Studio Code workspaces in Restricted Mode and inspect .vscode/tasks.json and package.json pre/postinstall hooks before trusting the workspace
• Isolate any device known to have run an interview/coding-test artifact, then rotate all browser-stored credentials, password-manager (KeePass/1Password) contents, and cryptocurrency wallet seed phrases accessible from it

Workarounds

• Require multi-person review and sign-off before any employee or contractor executes third-party code obtained through a job-interview process
• Monitor and restrict outbound traffic from developer endpoint segments to disposable hosting/shortener services such as Vercel-hosted staging pages and short.gy links

Longer-term hardening

• Isolate coding-test and interview environments in non-persistent virtual machines separate from production credentials and wallets
• Enforce application control/allow-listing to restrict unmanaged Node.js, Python, and PowerShell execution on developer endpoints
• Deploy EDR tuned to flag code-editor-to-shell-to-network execution chains, unexpected AnyDesk installs, and Registry Run-key persistence
• Require dependency provenance/lockfile review before installing npm, PyPI, Go, Rust, or Composer packages introduced via an unsolicited job or interview process
• Move developer secrets out of .env files and into just-in-time credential vaults

Affected and fixed versions

• npm, Inc. / OpenJS Foundation — npm public package registry
  Vulnerable versions: N/A — malicious first-party package uploads (e.g. dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz, node-nvm-ssh), not a registry software vulnerability
  Fixed in: N/A
• Python Software Foundation — PyPI public package registry
  Vulnerable versions: N/A — malicious first-party package uploads (e.g. logutilkit, apachelicense, fluxhttp, license-utils-kit)
  Fixed in: N/A
• Open Source / crates.io, pkg.go.dev, Packagist — Go module, Rust crate, and Packagist/PHP registries
  Vulnerable versions: N/A — malicious packages (e.g. github.com/golangorg/formstash, github.com/aokisasakidev/mit-license-pkg, logtrace crate, golangorg/logkit)
  Fixed in: N/A
• Microsoft — Visual Studio Code
  Vulnerable versions: N/A — workspace-trust / .vscode/tasks.json auto-execution abused via social engineering, not a VS Code product vulnerability
  Fixed in: N/A

Timeline of WaterPlum crypto theft campaign

• 2022-12-01 Contagious Interview activity (fake job-interview lures delivering locked-ioc-22/locked-ioc-9) first documented in the wild.
• 2024-09-01 locked-ioc-18, a JavaScript RAT/infostealer complementary to locked-ioc-22, is first observed in real-world Contagious Interview attacks.
• 2025-08-20 The malicious npm package locked-ioc-14, using a postinstall hook to stage the infection chain, is published to the npm registry.
• 2025-08-26 locked-ioc-14 is removed from the npm registry after detection.
• 2025-10-01 Cisco Talos reports locked-ioc-18 'v5' has merged characteristics of locked-ioc-22, blurring the line between the two malware families and adding heavier obfuscation and VM-detection.
• 2025-12-01 Start of the infection window later quantified by the September 2026 joint advisory (30,000+ devices, 100+ countries).
• 2026-03-11 Microsoft publishes a detailed technical writeup on the Contagious Interview campaign, mapping TTPs including locked-ioc-10's Registry Run-key persistence.
• 2026-04-01 Researchers report over 1,700 malicious packages tied to the campaign spread across npm, PyPI, Go, and Rust ecosystems since January 2025.
• 2026-07-01 End of the infection window covered by the joint advisory; a related 108-package/extension 'PolinRider' wave is separately reported around this period.
• 2026-09-18 Japan's NPA/National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's ASD Cyber Security Centre, and Germany's BND/BfV jointly publish an advisory attributing WaterPlum/Contagious Interview to North Korea's 313 General Bureau and quantifying $10.71M (1.7B JPY) in crypto theft from 7,000+ wallets across 30,000+ infected devices.
• 2026-09-19 BleepingComputer and other outlets report on the joint advisory's findings.

Sources cited for WaterPlum crypto theft campaign

• Joint Cybersecurity Advisory: North Korean "WaterPlum" (Contagious Interview) Cyber Actor Group Targeting IT Professionals ic3.gov · Advisory · 2026-09-18
• North Korean "WaterPlum," commonly referred to as "Contagious Interview," cyber actor group targeting IT professionals cyber.gov.au · Advisory · 2026-09-18
• North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware The Hacker News · Research · 2025-10-01
• BeaverTail (Malware Family) malpedia.caad.fkie.fraunhofer.de · Research · 2026-01-01
• Contagious Interview: Malware delivered through fake developer job interviews Microsoft · Vendor report · 2026-03-11
• WaterPlum: North Korean Campaign Infects 30,000 Devices via Fake Interview Tasks dev.to · Blog · 2026-09-19
• North Korean WaterPlum hackers infected 30,000 devices worldwide BleepingComputer · News · 2026-09-19
• North Korean WaterPlum Hackers Infect 30,000 Devices via Fake Job Interviews to Steal Crypto cyberpress.org · News · 2026-09-19
• North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto gbhackers.com · News · 2026-09-19
• How a laptop farm works: advisory issued by Japan against North Korean group WaterPlum ministryofcyberaffairs.com · News · 2026-09-19
• N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust The Hacker News · News · 2026-04-01

More in apt

• TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties
• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods
• APT29 Watering-Hole Campaign Against Mongolian Government Sites Using iOS WebKit and Chrome Android Exploits (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671)
• Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix)
• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)

More from WageMole

• Famous Chollima (North Korea) APT: Contagious Interview Campaigns, BeaverTail/OtterCookie/InvisibleFerret Malware and Fake IT Worker Operations
• Void Dokkaebi (Famous Chollima) Cython-Compiled InvisibleFerret Infostealer Campaign
• North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue from 70+ U.S. Companies
• ChainDrop npm Worm and PolinRider DPRK-Linked Operation Use Blockchain C2 to Steal Cloud and CI/CD Credentials
• North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
• Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script Detection

Previous and next in apt

• NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages