# North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages

> A joint advisory from Japan's NPA, US FBI/IC3, Australia's ASD Cyber Security Centre, and Germany's BND/BfV attributes North Korea's 313 General Bureau-linked WaterPlum group (the actor behind the long-running 'Contagious Interview' campaign) to infecting at least 30,000 devices across 100+ countries between December 2025 and July 2026. The group used fake recruiter outreach, sham job interviews/coding tests, and malicious npm/PyPI/Go/Rust/Packagist packages plus trojanized VS Code projects to deploy the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware families, compromising over 7,000 cryptocurrency wallets and moving $10.71 million (1.7 billion JPY) to North Korea.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2581
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-waterplum-crypto-theft-campaign-tl-2026-2581.webp?v=49a33d64 (Threadlinqs threat intel: WaterPlum Infects 30K Devices for Crypto: Detection & IOCs (TL-2026-2581) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-2581
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30

## Description

WaterPlum — publicly tracked interchangeably as Contagious Interview, Famous Chollima, DeceptiveDevelopment, CL-STA-0240, UNC5342, PurpleBravo, Void Dokkaebi, WageMole, Nickel Tapestry, Storm-1877, and Gwisin Gang — is a North Korean cyber-enabled financial crime operation that a September 18, 2026 joint advisory (Japan NPA/National Cybersecurity Office, US FBI and DoD Cyber Crime Center, Australia's ASD Cyber Security Centre, and Germany's BND/BfV) formally ties to the 313 General Bureau of the Munitions Industry Department under North Korea's Workers' Party Central Committee — the same command structure the advisory links to North Korea's fraudulent overseas IT-worker ('laptop farm') schemes.

The operation runs a two-track model: (1) DPRK operatives are hired as freelance/remote developers on crowdsourcing and gig platforms using stolen or fabricated identities, laptop farms (a domestic 'enabler' hosts a company-issued or locally purchased laptop while a remote DPRK-based operator controls it over VPN chains such as Astrill VPN, NETNUT Proxy, and High Speed Rabbit Proxy), earning legitimate wages that evade sanctions; and (2) the same actor set runs 'Contagious Interview,' posing as recruiters for fictitious or impersonated AI, cryptocurrency, and NFT companies to lure real software developers, web freelancers, and blockchain specialists via social media, job boards, gig-work platforms, and freelance marketplaces. Victims are walked through a fake virtual technical interview or coding assignment — sometimes with the interviewer using AI face-swapping software before disconnecting the video feed — and are told to clone and run a code repository or npm/PyPI/Go/Rust package hosted on GitHub, GitLab, or Bitbucket to complete the 'test.'

The payloads escalate across five named malware families sharing infrastructure and code lineage: BeaverTail (a heavily obfuscated JavaScript infostealer/loader embedded in npm packages, historically the first stage that fetches InvisibleFerret), InvisibleFerret (a Python-based multi-stage backdoor for reconnaissance, remote command execution, and further payload staging), OtterCookie (a JavaScript RAT/infostealer first seen in the wild in September 2024, whose October 2025 'v5' variant merged BeaverTail characteristics per Cisco Talos and added VM/sandbox-detection and heavier obfuscation), OtterCandy (an OtterCookie-RAT hybrid), and StoatWaffle (modular Node.js malware delivered through malicious VS Code projects whose .vscode/tasks.json or postinstall hooks execute automatically once a workspace is trusted). A related loader family, FlexibleFerret, persists via Windows Registry Run keys and supports encrypted HTTP/TCP C2 with dynamic plugin loading.

Distribution is a cross-ecosystem software-supply-chain operation: Socket and other researchers have tracked more than 1,700 malicious packages tied to the broader campaign since January 2025, spanning npm, PyPI, Go modules, Rust crates, and Packagist/PHP, with names disguised as mundane logging/licensing utilities (e.g., dev-log-core, logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz on npm; logutilkit, apachelicense, fluxhttp, license-utils-kit on PyPI; formstash and mit-license-pkg as Go modules; logtrace as a Rust crate; logkit on Packagist) so the malicious code sits inside functions that match the package's advertised purpose rather than firing on install. Earlier-stage droppers observed in the same cluster (node-nvm-ssh, published and pulled from npm in August 2025) used postinstall hooks, while legitimate npm dependencies such as node-global-key-listener, screenshot-desktop, and socket.io-client were repurposed inside the malware for keylogging, screen capture, and Socket.IO-based C2 respectively. Staging infrastructure has leaned on abused legitimate web services — Vercel-hosted (vercel.app) pages and the short.gy URL shortener — to host or redirect to payloads.

Once executed, the malware harvests browser-stored credentials and cookies, monitors the clipboard and keystrokes, captures screenshots, enumerates and drains cryptocurrency wallet private keys and seed phrases, scrapes KeePass/1Password credential stores and .env files, and exfiltrates identity documents (used downstream for further impersonation), while installing AnyDesk for hands-on-keyboard remote access. The September 2026 advisory quantifies the resulting damage at 30,000+ infected devices in 100+ countries, 7,000+ compromised cryptocurrency wallets, and $10.71 million (1.7 billion JPY) transferred to North Korea between December 2025 and July 2026 — continuing activity documented as far back as December 2022 under the Contagious Interview name, and as recently as a July 2026 108-package/extension 'PolinRider' wave publicized after the advisory's coverage window closed.

## MITRE ATT&CK

- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1566.003 Spearphishing via Service
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.006 Python
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036.005 Match Legitimate Resource Name or Location
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1113 Screen Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BeaverTail/InvisibleFerret/OtterCookie Credential Store, Crypto Wallet, and .env Harvesting with Keylogging/Screen Capture** (`TL-2026-2581-SPL-002`)

Detects a Node.js or Python process (consistent with BeaverTail, InvisibleFerret, OtterCookie/OtterCandy, or StoatWaffle) accessing browser credential stores, KeePass/1Password vault files, .env files, or cryptocurrency wallet files (wallet.dat, Electrum, MetaMask/Exodus leveldb stores), combined with loading of repurposed legitimate npm dependencies (node-global-key-listener for keylogging, screenshot-desktop for screen capture) — post-exploitation collection consistent with the campaign's 7,000+ drained crypto wallets.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555, T1552.001, T1056.001, T1113, T1082
- **Data sources:** sysmon, windows_security, edr_file_telemetry, browser_credential_store
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon OR index=edr (EventCode=11 OR EventCode=1)
| eval img_lc=lower(Image), tgt_lc=lower(TargetFilename), cl_lc=lower(CommandLine)
| where match(img_lc, "(node\.exe|python(3)?\.exe)$")
| eval sensitive_target=if(match(tgt_lc, "(login data|local state|cookies|\.kdbx|1password|\.env$|wallet\.dat|electrum|metamask|exodus|leveldb)"), 1, 0)
| eval capture_module=if(match(cl_lc, "(node-global-key-listener|screenshot-desktop|clipboardy|robotjs)"), 1, 0)
| where sensitive_target=1 OR capture_module=1
| table _time, ComputerName, User, Image, TargetFilename, CommandLine, sensitive_target, capture_module
| sort -_time
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe","python.exe","python3.exe")
| where FileName has_any ("Login Data","Local State","Cookies",".kdbx","1password",".env","wallet.dat","electrum","metamask","exodus","leveldb")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName in~ ("node.exe")
    | where ProcessCommandLine has_any ("node-global-key-listener","screenshot-desktop","clipboardy","robotjs")
    | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName=ProcessCommandLine, FolderPath=""
)
| order by Timestamp desc
```

### Sigma

```yaml
title: Node.js/Python Process Accessing Credential Stores, Crypto Wallets, or .env with Keylog/Screen-Capture Modules (WaterPlum Collection)
id: 4a9d1e6c-8f22-4b7a-b3d5-9e6c1f0a2b77
status: experimental
description: Detects file access to browser credential stores, password-manager vaults, .env files, and cryptocurrency wallet files by node.exe/python.exe, alongside repurposed keylogging/screenshot npm modules — consistent with BeaverTail/InvisibleFerret/OtterCookie post-exploitation collection in the WaterPlum/Contagious Interview campaign.
references:
  - https://www.ic3.gov/CSA/2026/260918.pdf
  - https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
  - attack.credential-access
  - attack.collection
  - attack.discovery
  - attack.t1555
  - attack.t1552.001
  - attack.t1056.001
  - attack.t1113
  - attack.t1082
  - attack.malware.beavertail
  - attack.malware.invisibleferret
  - attack.malware.ottercookie
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
  selection_target:
    TargetFilename|contains:
      - 'Login Data'
      - 'Local State'
      - 'Cookies'
      - '.kdbx'
      - '1Password'
      - '.env'
      - 'wallet.dat'
      - 'electrum'
      - 'metamask'
      - 'exodus'
      - 'leveldb'
  condition: selection_process and selection_target
falsepositives:
  - Legitimate password-manager sync clients or backup tools accessing the same vault paths
  - Developer tooling that legitimately reads .env files for local configuration
level: high
```

**Known false positives:**

- Legitimate password-manager sync clients or backup tools accessing the same vault paths
- Developer tooling that legitimately reads .env files for local configuration

**Tuning notes:** Baseline which developer tools legitimately touch .env/wallet paths (e.g. dotenv-vault clients, hardware-wallet bridges) and exclude their signed binaries by hash; correlate with TL-2026-2581-SPL-001 firing on the same host within 24h to prioritize triage, since standalone file access alone has moderate false-positive volume.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WaterPlum Malicious npm/PyPI/Go/Rust Package Install with Postinstall Hook or VS Code Workspace Auto-Exec (locked: unlock with TL Creds)
- BeaverTail/InvisibleFerret/OtterCookie Credential Store, Crypto Wallet, and .env Harvesting with Keylogging/Screen Capture (locked: unlock with TL Creds)
- FlexibleFerret Registry Run-Key Persistence with Encrypted C2 Beaconing, AnyDesk Install, and Clipboard/Exfil Activity (locked: unlock with TL Creds)
- WaterPlum Malicious npm/PyPI/Go/Rust Package Install with Postinstall Hook or VS Code Workspace Auto-Exec (locked: unlock with TL Creds)
- BeaverTail/InvisibleFerret/OtterCookie Credential Store, Crypto Wallet, and .env Harvesting with Keylogging/Screen Capture (locked: unlock with TL Creds)
- FlexibleFerret Registry Run-Key Persistence with Encrypted C2 Beaconing, AnyDesk Install, and Clipboard/Exfil Activity (locked: unlock with TL Creds)
- WaterPlum Malicious npm/PyPI/Go/Rust Package Install with Postinstall Hook or VS Code Workspace Auto-Exec (locked: unlock with TL Creds)
- FlexibleFerret Registry Run-Key Persistence with Encrypted C2 Beaconing, AnyDesk Install, and Clipboard/Exfil Activity (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [North Korean WaterPlum hackers infected 30,000 devices worldwide](https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/)
- [Joint Cybersecurity Advisory: North Korean "WaterPlum" (Contagious Interview) Cyber Actor Group Targeting IT Professionals](https://www.ic3.gov/CSA/2026/260918.pdf)
- [North Korean "WaterPlum," commonly referred to as "Contagious Interview," cyber actor group targeting IT professionals](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/north-korean-waterplum-commonly-referred-to-as-contagious-interview-cyber-actor-group-targeting-it-professionals)
- [North Korean WaterPlum Hackers Infect 30,000 Devices via Fake Job Interviews to Steal Crypto](https://cyberpress.org/north-korean-waterplum-hackers-infect-30000-devices/)
- [WaterPlum: North Korean Campaign Infects 30,000 Devices via Fake Interview Tasks](https://dev.to/anoymask/waterplum-north-korean-campaign-infects-30000-devices-via-fake-interview-tasks-4528)
- [North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto](https://gbhackers.com/north-korean-waterplum-hackers-target-it-professionals/)
- [How a laptop farm works: advisory issued by Japan against North Korean group WaterPlum](https://ministryofcyberaffairs.com/news/how-a-laptop-farm-works-advisory-issued-by-japan-against-north-korean-group-waterplum-0f4c4b09-6ffb-4401-a92b-be53b0f24081)
- [North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware](https://thehackernews.com/2025/10/north-korean-hackers-combine-beavertail.html)
- [BeaverTail (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail)
- [N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust](https://thehackernews.com/2026/04/n-korean-hackers-spread-1700-malicious.html)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2581