# North Korean Contagious Interview (WaterPlum) Campaign Compromises 30,000+ Devices, Steals $10.71M in Crypto

> North Korean operators running the Contagious Interview (WaterPlum) campaign infected at least 30,000 devices in 100+ countries and took funds or credentials from 7,000+ crypto wallets, moving about JPY 1.7bn (~$10.71M) to North Korea. Victims are lured by fake recruiters into running trojanized coding assessments that deliver BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle. A joint advisory from Japan, the U.S., Australia and Germany (reference 260918, 18 Sep 2026) also links the actors to DPRK IT worker schemes using proxy hiring and laptop farms.

- **Published:** 2026-11-11T16:56:11Z
- **Last reviewed:** 2026-11-11T16:56:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5782
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5782.png
- **ID:** TL-2026-5782
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (2 shown free below)

## Description

Contagious Interview is a long-running North Korean campaign (active since at least late 2022) tracked under many names, including WaterPlum, CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342 and Void Dokkaebi. A joint advisory published 18 September 2026 by Japan's National Police Agency and the FBI, with the DoD Cyber Crime Center and Australian and German agencies, reports at least 30,000 infected devices across 100+ countries between roughly December 2025 and July 2026, with funds or credentials taken from 7,000+ crypto wallets and about JPY 1.7bn (~$10.71M) transferred to North Korea. Japan's NPA and the FBI assess that WaterPlum operators and some North Korean IT workers report to the 313 General Bureau of the Munitions Industry Department. This analysis is based on press coverage of the advisory and vendor reports; the advisory PDF itself could not be parsed, and no press source lists network IOCs from it.

Initial access is social engineering. Operators pose as recruiters or hiring managers from AI, crypto or NFT companies and approach web designers, engineers and crypto/Web3 specialists via LinkedIn and other social media, job boards, freelance marketplaces, Discord and Slack. The target is asked to take a coding test or fix a bug by downloading and running a project. Delivery variants documented by vendors: malicious npm dependencies (e.g. node-nvm-ssh, with a postinstall hook running a 'skip' script that loads index.js and file15.js; the compromised rand-user-agent package was used to distribute RATatouille); trojanized repositories whose SVG assets hide base64 payload fragments reassembled by serverValidation.js (Elastic, REF9403); ClickFix-style fake assessment pages that have the victim paste a command (OtterCandy via DiggingBeaver); and blockchain-themed VS Code projects whose tasks.json uses runOn folderOpen so StoatWaffle runs once the victim trusts the folder (NTT Security). Separate macOS malvertising reported by AllSecure and attributed to the same activity uses a fake update screen, a clipboard-pasted curl command, a Node.js backdoor persisted via LaunchAgent, and EtherHiding to resolve C2.

Payloads steal browser credentials and extension data, keystrokes, clipboard contents, screenshots, crypto wallet keys and seed phrases, and ID images, and provide RAT access (OtterCandy and OtterCookie use Socket.IO C2; StoatWaffle's RAT polls C2 for commands such as running shell commands, running Node.js code, listing and uploading files). A compromised developer device can give access to the employer for espionage, source code theft and lateral movement, and stolen ID images can be reused by IT workers to impersonate victims.

The advisory ties the campaign to IT worker schemes: WaterPlum and IT worker clusters used the same IP addresses to access laptop farms and crowdsourcing services and to apply to a Japanese crypto exchange. Silent Push documents a Discord-based proxy-hiring scheme (35% to the proxy, 65% to the operative) with remote desktop tools used during live coding tests. Kudelski Security reports Astrill VPN and Mullvad exit nodes in targeted regions, and Recorded Future reports PurpleBravo C2 administered via Astrill VPN and Chinese IP ranges. Japan dismantled its first known domestic laptop farm.

## MITRE ATT&CK

- T1585.001 Establish Accounts: Social Media Accounts
- T1566.003 Phishing: Spearphishing via Service
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1204.002 User Execution: Malicious File
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1543.001 Create or Modify System Process: Launch Agent
- T1497 Virtualization/Sandbox Evasion
- T1684.001 Impersonation
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.001 Credentials from Password Stores: Keychain
- T1056.001 Input Capture: Keylogging
- T1113 Screen Capture
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1102.001 Web Service: Dead Drop Resolver
- T1090 Proxy
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Contagious Interview npm postinstall dropper chain (node-nvm-ssh / BeaverTail / OtterCookie) - Exploitation** (`TL-2026-5782-SPL-001`)

Detects the Contagious Interview (WaterPlum) npm delivery chain on developer endpoints: npm/node parents spawning node, shells or downloaders whose command lines reference node-nvm-ssh, rand-user-agent, Chessfi, the 'skip' postinstall script, file15.js or serverValidation.js, or an index.js launched from a postinstall hook. Behaviour-first: also fires on any download cradle (curl, wget, Invoke-WebRequest, base64 decode, vercel.app) spawned inside an npm chain. Maps to BeaverTail/OtterCookie first-stage execution after a victim runs a fake coding assessment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1059.007, T1204.002
- **Data sources:** Sysmon EventCode 1 (index=endpoint, sourcetype XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), Microsoft Defender DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  (Image="*node.exe" OR Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*curl.exe")
  (ParentImage="*node.exe" OR ParentImage="*npm.cmd" OR ParentCommandLine="*npm*" OR ParentCommandLine="*postinstall*")
| eval cmd=lower(CommandLine), pcmd=lower(ParentCommandLine)
| eval detection_reason=case(match(cmd,"file15[.]js|servervalidation[.]js|node-nvm-ssh|rand-user-agent|chessfi|npm run skip"),"known_contagious_interview_ioc", match(cmd,"index[.]js") AND match(pcmd,"postinstall|npm"),"postinstall_index_js", match(cmd,"curl|wget|invoke-webrequest|frombase64string|vercel[.]app"),"downloader_inside_npm_chain", true(),null())
| where isnotnull(detection_reason)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines values(detection_reason) as detection_reason by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('node.exe', 'node', 'npm.cmd', 'npm') or InitiatingProcessCommandLine has_any ('npm install', 'postinstall', 'node-nvm-ssh')
| extend Reason = case(
    ProcessCommandLine has_any ('file15.js', 'serverValidation.js', 'node-nvm-ssh', 'rand-user-agent', 'Chessfi', 'npm run skip'), 'known_contagious_interview_ioc',
    ProcessCommandLine has 'index.js' and InitiatingProcessCommandLine has_any ('postinstall', 'npm'), 'postinstall_index_js',
    FileName in~ ('curl.exe', 'curl', 'wget', 'powershell.exe', 'pwsh.exe') and InitiatingProcessFileName in~ ('node.exe', 'node'), 'downloader_spawned_by_node',
    '')
| where Reason != ''
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Reason, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Contagious Interview npm Postinstall Dropper Chain
id: 2f6b8a14-93c5-4d07-a1e2-7b50c9d3e401
status: experimental
description: Detects node-nvm-ssh / rand-user-agent / Chessfi npm chains and node-spawned downloaders used by the Contagious Interview (WaterPlum) campaign to deliver BeaverTail and OtterCookie.
references:
  - https://www.ic3.gov/CSA/2026/260918.pdf
  - https://thehackernews.com/2025/10/north-korean-hackers-combine-beavertail.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.007
  - attack.t1204.002
  - attack.s1246
logsource:
  category: process_creation
  product: windows
detection:
  selection_ioc:
    CommandLine|contains:
      - 'file15.js'
      - 'serverValidation.js'
      - 'node-nvm-ssh'
      - 'rand-user-agent'
      - 'Chessfi'
      - 'npm run skip'
  selection_node_downloader:
    ParentImage|endswith: '\node.exe'
    Image|endswith:
      - '\curl.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: 1 of selection_*
falsepositives:
  - Developers legitimately installing the rand-user-agent package (only the compromised May 2025 release is malicious)
  - Build scripts that call curl or PowerShell from a node-based tool
level: high
```

**Known false positives:**

- Developers installing the legitimate rand-user-agent package or running build tooling that shells out to curl/PowerShell from node
- CI/CD agents running npm postinstall scripts that download binaries

**Tuning notes:** Exclude known CI runner hosts and approved internal package scopes; restrict to developer workstation groups. Keep the known-IOC branch unfiltered and alert on the generic downloader branch only from non-build hosts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- VS Code [indicator] runOn folderOpen auto-execution spawning shells or downloaders (StoatWaffle) - Exploitation (locked: unlock with TL Creds)
- Script-runtime LaunchAgent persistence and Chrome Secure Preferences tampering (macOS chain) - Post-Exploitation (locked: unlock with TL Creds)
- EtherHiding blockchain RPC resolution of C2 from node or Python (Contagious Interview) - C2 (locked: unlock with TL Creds)
- ClickFix fake-assessment pasted curl-to-shell or inline node command (OtterCandy / [indicator]) - Exploitation (locked: unlock with TL Creds)
- Node.js stealer reconnaissance - VM checks, clipboard, screen capture and credential-store reads (OtterCookie) - Post-Exploitation (locked: unlock with TL Creds)
- DNS and network contact with Contagious Interview EtherHiding domains and community-observed DPRK sibling C2 - C2 (locked: unlock with TL Creds)
- Contagious Interview stealer access to keychain, browser credential stores and wallet extension data - Post-Exploitation (locked: unlock with TL Creds)
- Contagious Interview Socket.IO RAT C2 and EtherHiding config domains in web telemetry - C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 26)

Defanged, TLP:CLEAR.

- Domain: `rg-telemetry[.]sbs`
- Domain: `th-updates[.]sbs`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto](https://thehackernews.com/2026/09/contagious-interview-campaign.html)
- [Joint Cybersecurity Advisory 260918 (Japan NPA, FBI, DC3, Australia, Germany)](https://www.ic3.gov/CSA/2026/260918.pdf)
- [Contagious Interview: 30,000 devices infected by a fake job interview](https://securityaffairs.com/199506/uncategorized/contagious-interview-30000-devices-infected-by-a-fake-job-interview.html)
- [North Korean Attackers Hit 30,000 Devices and Steal $10.7m](https://www.infosecurity-magazine.com/news/north-korean-waterplum-30000/)
- [Silent Push: North Korean IT worker proxy-hiring via Discord](https://www.silentpush.com/blog/nk-it-worker/)
- [North Korean Hackers Abuse VS Code Auto-Run Tasks (StoatWaffle, NTT Security)](https://thehackernews.com/2026/03/north-korean-hackers-abuse-vs-code-auto.html)
- [North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses (Recorded Future Insikt)](https://thehackernews.com/2026/01/north-korean-purplebravo-campaign.html)
- [North Korean Hackers Combine BeaverTail and OtterCookie (OtterCandy, RATatouille)](https://thehackernews.com/2025/10/north-korean-hackers-combine-beavertail.html)
- [North Korea-linked hackers hide OtterCookie in SVG images (Elastic REF9403)](https://thehackernews.com/2026/07/north-korea-linked-hackers-hide.html)
- [DPRK-linked macOS malvertising uses EtherHiding (AllSecure)](https://thehackernews.com/2026/07/dprk-linked-macos-malvertising-uses.html)
- [Japan NPA: North Korean IT worker report](https://www.npa.go.jp/bureau/security/northkorea_IT/NK_IT_202607.html)
- [Sekoia: Beyond Lazarus, organization of DPRK cyber capabilities](https://www.sekoia.com/blog/beyond-lazarus-organization-of-dprk-cyber-capabilities)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5782