At a Glance Summary Attribute Details Actor or Group North Korean WaterPlum cyber actor group (Contagious Interview) Activity Type Fake job recruitment, malware distribution, and cryptocurrency theft Targets or Victims Individual IT professionals, software developers, and web freelancers Scale Over 30,000 devices infected; $10.71 million USD claimed stolen Jurisdiction / Status Suspected state-sponsored actors under the 313 General Bureau Source…

https://www.osintinvestigate.com North Korea-linked hackers reportedly compromised more than 30,000 devices and over 7,000 crypto wallets using fake job offers, stealing at least $10.7 million in digital assets.

Rust Project maintainers and crate developers are being targeted by attackers who pose as recruiters or collaborators to trick victims into running malicious code or revealing credentials. The campaign is linked to Contagious Interview (aka WaterPlum), a North Korean operation that has compromised thousands of devices and cryptocurrency wallets worldwide. #RustProject #ContagiousInterview #WaterPlum #cratesio

North Korean cyber group WaterPlum, also known as Contagious Interview, stole at least $10.7 million by posing as job recruiters for crypto and AI firms, infecting over 30,000 devices in more than 100 countries, according to a joint advisory from Japan, Germany, Australia, and the US.

North Korean cyber group WaterPlum, also known as Contagious Interview, stole at least $10.7 million by posing as job recruiters for crypto and AI firms, infecting over 30,000 devices in more than 100 countries, according to a joint advisory from Japan, Germany, Australia, and the US.

Sicherheitsbehörden warnen vor einer Cybergruppe aus Nordkorea, die gezielt IT-Spezialisten angreift. Was hinter der Kampagne „Contagious Interview“ steckt.

Cet advisory conjoint expose les activités du groupe nord-coréen WaterPlum, également connu sous le nom de Contagious Interview. WaterPlum est attribué à la Corée du Nord et opère sous le 313e Bureau général du Département de l'industrie des munitions, subordonné au Comité central du Parti des travailleurs de Corée.

Researchers have discovered 13 npm packages carrying a previously undocumented JavaScript information stealer called WeaselBiscuit, introducing yet another malicious threat to the npm package ecosystem. In addition to linking the packages together via shared indicators, OpenSourceMalware found several similarities between BeaverTail and OtterCookie, two North Korean malware families.  A number of packages are included, including @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, @biz44/engin1, id79-client, process-lhpm, process-mite, and process-tailwind. Many were first observed between September 12 and September 16, 2026, with some versions still available on NPM at the time of analysis.  In comparison to BeaverTail and OtterCookie, WeaselBiscuit appears much smaller. In addition to remote access and cryptocurrency theft functions, the malware focuses on profiling hosts and collecting data collected by Chrome extensions rather than carrying a broad range of remote access functions. Malware loaders are launched when a compromised package is imported, causing detached Node.js processes to begin execution. After retrieving an encoded payload from an Npoint URL, the loader executes the decoded code directly in memory. Following execution, the malware obtains its command-and-control configuration from another Npoint endpoint before connecting to 103.170.217.184:8787. Among the data collected are hostnames, usernames, operating systems, CPUs, and memory, as well as local and public IP addresses.  Chrome profiles are also searched for extension storage on Windows, Mac OS, and Linux platforms. Chrome's Local Extension Settings directory may contain information associated with browser extensions, including cryptocurrency wallet extensions, which makes this collection especially significant.  Instead of relying on a specific list of wallet extensions, OpenSourceMalware reported the stealer uploads readable, non-empty files from these locations. C2 servers can also provide commands for monitoring the clipboard and logging Windows keystrokes.  Despite these capabilities, the recovered malware does not include direct wallet draining functionality, browser password decryption, seed phrase searching, screenshots, or a remote shell access. Additionally, some BeaverTail and OtterCookie activities have a Python-based InvisibleFerret stage that is not present in any other activity.  Possible Links to DPRK Malware WeaselBiscuit has been compared to malware associated with the DPRK-linked Contagious Interview campaign, but the attribution has yet to be confirmed. OpenSourceMalware did not find conclusive evidence that the attack was originated by North Korea based on operational infrastructure, victimology, campaign metadata or other identifying materials.  WeaselBiscuit employs the dead-drop technique of Npoint.io as a dead-drop service, a technique previously observed in Contagious Interview campaigns. Some of its technical indicators, however, overlap with earlier campaigns. Additionally, its code performs public IP and geolocation checks using IPify.org and IP-API.com, while parts of its command-and-control design are similar to OtterCookie's.  Among the numeric identifiers found in the malware are 10, 12, 44, 79, 95, and 99. These identifiers are similar to campaign markers associated with PolinRider activity, however their exact purpose in WeaselBiscuit is unclear. In terms of capability, BeaverTail and OtterCookie are more closely related.  Several features are retained in WhistlerBiscuit, including system profiling, Chrome extension data collection, clipboard monitoring, and keylogging, all of which are common to those malware families. However, several of their heavier features are removed, including remote access functions, wallet draining capabilities, screenshots, and secondary payload delivery.  Researchers at Cisco Talos observed a similar overlap in October 2025, when they discovered that the node-nvm-ssh package contained characteristics related to both BeaverTail and OtterCookie. The findings suggest that code and techniques from these malware families have been found in a variety of combinations within npm-based malicious code.  The WeaselBiscuit stealer should be viewed for the time being as a distinctive lightweight stealer with distinct technical similarities to DPRK-related tooling rather than a new DPRK malware family confirmed by the DPRK. For a more conclusive attribution, further evidence from infrastructure, campaigns, or code levels would be required. With the discovery of WeaselBiscuit, security risks are highlighted within the npm ecosystem, particularly for developers utilizing third-party packages. In addition to the ability to collect Chrome extension data and similarity to BeaverTail and OtterCookie, it warrants continued investigation as researchers investigate its origins and wider activities.

WaterPlum, a North Korean hacking group, compromised at least 30,000 devices in more than 100 countries and sent over $10.7 million in stolen cryptocurrency to North Korea. The campaign used fake interviews, malicious coding tests, and recruiter impersonation to spread malware and steal credentials, wallet data, and identity documents. #WaterPlum #ContagiousInterview #BeaverTail #InvisibleFerret #OtterCookie #OtterCandy #StoatWaffle #DPRK

North Korean hackers linked to WaterPlum, also known as Contagious Interview, are posing as AI companies and other employers to target job seekers, especially software developers and IT professionals. The campaign has infected more than 30,000 devices worldwide and helped move nearly $11 million in cryptocurrency to North Korea through stolen credentials and fake recruiting schemes. #WaterPlum #ContagiousInterview #NorthKorea #FBI

At a glance Field Details Actor or Group Suspected DPRK-affiliated operators (Contagious Interview cluster) Activity Type Malware delivery using trojanized application installers Targets or Victims Software engineers, job candidates, and Web3 developers Scale Fourteen trojanized application packages identified Jurisdiction Status Active tracking by threat researchers; no official arrests announced Source Jamf Threat Labs, Elastic Security Labs, and CITIZENDOT Executive Summary…