Skip to navigation

Threat reportAPTTL-2026-5782

North Korean Contagious Interview (WaterPlum) Campaign Compromises 30,000+ Devices, Steals $10.71M in Crypto

highACTIVE

North Korean operators running the Contagious Interview (WaterPlum) campaign infected at least 30,000 devices in 100+ countries and took funds or credentials from 7,000+ crypto wallets, moving about JPY 1.7bn (~$10.71M) to North Korea. Victims are lured by fake recruiters into running trojanized coding assessments that deliver BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle. First disclosed .

Key facts

IdentifiersTL-2026-5782
Also known asContagious Interview, WaterPlum, PurpleBravo
SeverityHIGH
First disclosed
Affected productsMultiple Developer and job-seeker workstations (Windows, macOS, Linux); Microsoft Visual Studio Code (workspace tasks.json auto-run when folder is trusted); npm npm packages (node-nvm-ssh, rand-user-agent compromise)
AttributionWageMole, Contagious Interview (high confidence)
Nation-state nexusNorth Korea
MalwareBeaverTail - S1246, FlexibleFerret, GolangGhost (OS X), InvisibleFerret - S1245, OtterCandy, OtterCookie, PylangGhost, RATatouille, StoatWaffle
ToolsAnyDesk, Google Drive Offline
MITRE ATT&CK techniquesT1005 Data from Local System, T1056.001 Input Capture: Keylogging, T1059.007 Command and Scripting Interpreter: JavaScript, T1090 Proxy, T1102.001 Web Service: Dead Drop Resolver, T1113 Screen Capture, T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools, T1204.002 User Execution: Malicious File, T1204.004 User Execution: Malicious Copy and Paste, T1219 Remote Access Tools, T1497 Virtualization/Sandbox Evasion, T1543.001 Create or Modify System Process: Launch Agent and 6 more in the attack flow
MotivationFINANCIAL
Target sectorscryptocurrency, blockchain, web3, software development, it services, ai, financial services, marketing
Target regionsGlobal, North America, Europe, japan, South Asia, Latin America, Middle East
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5782 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Contagious Interview npm postinstall dropper chain (node-nvm-ssh / BeaverTail / OtterCookie) - Exploitation

Detects the Contagious Interview (WaterPlum) npm delivery chain on developer endpoints: npm/node parents spawning node, shells or downloaders whose command lines reference node-nvm-ssh, rand-user-agent, Chessfi, the 'skip' postinstall script, file15.js or serverValidation.js, or an index.js launched from a postinstall hook. Behaviour-first: also fires on any download cradle (curl, wget, Invoke-WebRequest, base64 decode, vercel.app) spawned inside an npm chain. Maps to BeaverTail/OtterCookie first-stage execution after a victim runs a fake coding assessment.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.001, T1059.007, T1204.002
  • Data sources: Sysmon EventCode 1 (index=endpoint, sourcetype XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), Microsoft Defender DeviceProcessEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  (Image="*node.exe" OR Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*curl.exe")
  (ParentImage="*node.exe" OR ParentImage="*npm.cmd" OR ParentCommandLine="*npm*" OR ParentCommandLine="*postinstall*")
| eval cmd=lower(CommandLine), pcmd=lower(ParentCommandLine)
| eval detection_reason=case(match(cmd,"file15[.]js|servervalidation[.]js|node-nvm-ssh|rand-user-agent|chessfi|npm run skip"),"known_contagious_interview_ioc", match(cmd,"index[.]js") AND match(pcmd,"postinstall|npm"),"postinstall_index_js", match(cmd,"curl|wget|invoke-webrequest|frombase64string|vercel[.]app"),"downloader_inside_npm_chain", true(),null())
| where isnotnull(detection_reason)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines values(detection_reason) as detection_reason by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('node.exe', 'node', 'npm.cmd', 'npm') or InitiatingProcessCommandLine has_any ('npm install', 'postinstall', 'node-nvm-ssh')
| extend Reason = case(
    ProcessCommandLine has_any ('file15.js', 'serverValidation.js', 'node-nvm-ssh', 'rand-user-agent', 'Chessfi', 'npm run skip'), 'known_contagious_interview_ioc',
    ProcessCommandLine has 'index.js' and InitiatingProcessCommandLine has_any ('postinstall', 'npm'), 'postinstall_index_js',
    FileName in~ ('curl.exe', 'curl', 'wget', 'powershell.exe', 'pwsh.exe') and InitiatingProcessFileName in~ ('node.exe', 'node'), 'downloader_spawned_by_node',
    '')
| where Reason != ''
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Reason, SHA256
| order by Timestamp desc

Sigma

title: Contagious Interview npm Postinstall Dropper Chain
id: 2f6b8a14-93c5-4d07-a1e2-7b50c9d3e401
status: experimental
description: Detects node-nvm-ssh / rand-user-agent / Chessfi npm chains and node-spawned downloaders used by the Contagious Interview (WaterPlum) campaign to deliver BeaverTail and OtterCookie.
references:
  - https://www.ic3.gov/CSA/2026/260918.pdf
  - https://thehackernews.com/2025/10/north-korean-hackers-combine-beavertail.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.007
  - attack.t1204.002
  - attack.s1246
logsource:
  category: process_creation
  product: windows
detection:
  selection_ioc:
    CommandLine|contains:
      - 'file15.js'
      - 'serverValidation.js'
      - 'node-nvm-ssh'
      - 'rand-user-agent'
      - 'Chessfi'
      - 'npm run skip'
  selection_node_downloader:
    ParentImage|endswith: '\node.exe'
    Image|endswith:
      - '\curl.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: 1 of selection_*
falsepositives:
  - Developers legitimately installing the rand-user-agent package (only the compromised May 2025 release is malicious)
  - Build scripts that call curl or PowerShell from a node-based tool
level: high

Known false positives:

  • Developers installing the legitimate rand-user-agent package or running build tooling that shells out to curl/PowerShell from node
  • CI/CD agents running npm postinstall scripts that download binaries

Tuning notes: Exclude known CI runner hosts and approved internal package scopes; restrict to developer workstation groups. Keep the known-IOC branch unfiltered and alert on the generic downloader branch only from non-build hosts.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • VS Code [indicator] runOn folderOpen auto-execution spawning shells or downloaders (StoatWaffle) - Exploitation · unlock with TL Creds
  • Script-runtime LaunchAgent persistence and Chrome Secure Preferences tampering (macOS chain) - Post-Exploitation · unlock with TL Creds
  • EtherHiding blockchain RPC resolution of C2 from node or Python (Contagious Interview) - C2 · unlock with TL Creds
  • ClickFix fake-assessment pasted curl-to-shell or inline node command (OtterCandy / [indicator]) - Exploitation · unlock with TL Creds
  • Node.js stealer reconnaissance - VM checks, clipboard, screen capture and credential-store reads (OtterCookie) - Post-Exploitation · unlock with TL Creds
  • DNS and network contact with Contagious Interview EtherHiding domains and community-observed DPRK sibling C2 - C2 · unlock with TL Creds
  • Contagious Interview stealer access to keychain, browser credential stores and wallet extension data - Post-Exploitation · unlock with TL Creds
  • Contagious Interview Socket.IO RAT C2 and EtherHiding config domains in web telemetry - C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5782.

Sample indicators (2 of 26)

  • Domain: rg-telemetry[.]sbs
  • Domain: th-updates[.]sbs

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

26 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

A joint advisory from Japan, the U.S., Australia and Germany (reference 260918, 18 Sep 2026) also links the actors to DPRK IT worker schemes using proxy hiring and laptop farms.

Contagious Interview is a long-running North Korean campaign (active since at least late 2022) tracked under many names, including WaterPlum, CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342 and Void Dokkaebi. A joint advisory published 18 September 2026 by Japan's National Police Agency and the FBI, with the DoD Cyber Crime Center and Australian and German agencies, reports at least 30,000 infected devices across 100+ countries between roughly December 2025 and July 2026, with funds or credentials taken from 7,000+ crypto wallets and about JPY 1.7bn (~$10.71M) transferred to North Korea. Japan's NPA and the FBI assess that WaterPlum operators and some North Korean IT workers report to the 313 General Bureau of the Munitions Industry Department. This analysis is based on press coverage of the advisory and vendor reports; the advisory PDF itself could not be parsed, and no press source lists network IOCs from it.

Initial access is social engineering. Operators pose as recruiters or hiring managers from AI, crypto or NFT companies and approach web designers, engineers and crypto/Web3 specialists via LinkedIn and other social media, job boards, freelance marketplaces, Discord and Slack. The target is asked to take a coding test or fix a bug by downloading and running a project. Delivery variants documented by vendors: malicious npm dependencies (e.g. node-nvm-ssh, with a postinstall hook running a 'skip' script that loads index.js and file15.js; the compromised rand-user-agent package was used to distribute RATatouille); trojanized repositories whose SVG assets hide base64 payload fragments reassembled by serverValidation.js (Elastic, REF9403); ClickFix-style fake assessment pages that have the victim paste a command (OtterCandy via DiggingBeaver); and blockchain-themed VS Code projects whose tasks.json uses runOn folderOpen so StoatWaffle runs once the victim trusts the folder (NTT Security). Separate macOS malvertising reported by AllSecure and attributed to the same activity uses a fake update screen, a clipboard-pasted curl command, a Node.js backdoor persisted via LaunchAgent, and EtherHiding to resolve C2.

Payloads steal browser credentials and extension data, keystrokes, clipboard contents, screenshots, crypto wallet keys and seed phrases, and ID images, and provide RAT access (OtterCandy and OtterCookie use Socket.IO C2; StoatWaffle's RAT polls C2 for commands such as running shell commands, running Node.js code, listing and uploading files). A compromised developer device can give access to the employer for espionage, source code theft and lateral movement, and stolen ID images can be reused by IT workers to impersonate victims.

The advisory ties the campaign to IT worker schemes: WaterPlum and IT worker clusters used the same IP addresses to access laptop farms and crowdsourcing services and to apply to a Japanese crypto exchange. Silent Push documents a Discord-based proxy-hiring scheme (35% to the proxy, 65% to the operative) with remote desktop tools used during live coding tests. Kudelski Security reports Astrill VPN and Mullvad exit nodes in targeted regions, and Recorded Future reports PurpleBravo C2 administered via Astrill VPN and Chinese IP ranges. Japan dismantled its first known domestic laptop farm.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.001 Input Capture: Keylogging; T1113 Screen Capture

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1090 Proxy; T1102.001 Web Service: Dead Drop Resolver; T1219 Remote Access Tools

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1566.003 Phishing: Spearphishing via Service

Defense Evasion

T1497 Virtualization/Sandbox Evasion; T1684.001 Impersonation

Persistence

T1543.001 Create or Modify System Process: Launch Agent

Credential Access

T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Resource Development

T1585.001 Establish Accounts: Social Media Accounts

Impact

T1657 Financial Theft

Remediation

Immediate actions

  • Open unknown VS Code projects in Restricted Mode and review tasks.json (runOn: folderOpen) before trusting a folder
  • Never run recruiter-supplied coding tests or repositories on corporate or wallet-holding devices; use disposable isolated VMs
  • Hunt for npm install activity that spawns node/shell child processes from postinstall hooks, and for the listed packages and files
  • Block or alert on the listed C2 domains and review outbound Socket.IO or Node.js traffic from developer endpoints
  • Rotate browser-stored credentials, SSH/cloud/npm keys and move crypto assets from wallets on any device that ran an interview assignment

Workarounds

  • Disable VS Code automatic task execution for untrusted workspaces
  • Block unsanctioned remote access tools (AnyDesk, TeamViewer, Chrome Remote Desktop) on interview or assessment devices

Longer-term hardening

  • Restrict contractor and new-hire access to source code and credentials
  • Verify applicant identities and watch for interview red flags: off-camera scripting, remote-control requests, unusually broad skills, preference for crypto payment
  • Assess subcontractor and downstream hiring risk for proxy-hiring and laptop-farm exposure
  • Deploy EDR with behavioral detection on developer workstations and monitor package registries for malicious dependencies
  • Monitor alerts from domestic and international security agencies and vendor reports

Affected and fixed versions

  • Multiple — Developer and job-seeker workstations (Windows, macOS, Linux)
    Vulnerable versions: Any system that runs a trojanized coding assessment
  • Microsoft — Visual Studio Code (workspace tasks.json auto-run when folder is trusted)
    Vulnerable versions: Workspaces trusted by the user
  • npm — npm packages (node-nvm-ssh, rand-user-agent compromise)
    Vulnerable versions: node-nvm-ssh; rand-user-agent (compromised May 2025 release)

Timeline

  • Contagious Interview campaign active since at least late 2022 (December 2022 per Elastic; late 2022 per Hacker News).
  • OtterCookie first seen in real-world attacks.
  • rand-user-agent npm package compromised in a supply chain attack and used to distribute RATatouille.
  • DTEX assessment links WaterPlum and IT workers to the 313 General Bureau of the Munitions Industry Department.
  • Malicious npm package node-nvm-ssh published by user 'trailer' (306 downloads, removed six days later); OtterCandy v2 observed the same month.
  • Abuse of VS Code locked-ioc-4 runOn:folderOpen begins; the advisory's theft window runs roughly December 2025 to July 2026.
  • Recorded Future Insikt reports PurpleBravo targeting 3,136 IP addresses and about 20 organizations, with C2 administered via Astrill VPN and Chinese IP ranges.
  • NTT Security analysis of StoatWaffle (VS Code locked-ioc-4 delivery) reported; Microsoft also analyzed the activity in March 2026.
  • Late May 2026: actor 'Maxwell' posts fake job offers in the #jobs channel of Elastic's community Slack workspace (trojanized e-commerce repo, REF9403).
  • Elastic Security Labs publishes the REF9403 SVG-hidden OtterCookie report.
  • AllSecure/Unit 42-linked reporting on DPRK macOS malvertising using ClickFix and EtherHiding; Kudelski and Japan NPA reports also published in July 2026.
  • Silent Push publishes its Discord 'Mouse Review' proxy-hiring report.
  • Joint advisory (reference 260918) from Japan NPA, FBI, DC3, Australia and Germany reports 30,000+ devices, 7,000+ wallets and about $10.71M stolen.
  • The Hacker News publishes coverage of the advisory.

Sources cited

More from WageMole

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats