North Korean cyber group WaterPlum, also known as Contagious Interview, stole at least $10.7 million by posing as job recruiters for crypto and AI firms, infecting over 30,000 devices in more than 100 countries, according to a joint advisory from Japan, Germany, Australia, and the US.

North Korean cyber group WaterPlum, also known as Contagious Interview, stole at least $10.7 million by posing as job recruiters for crypto and AI firms, infecting over 30,000 devices in more than 100 countries, according to a joint advisory from Japan, Germany, Australia, and the US.

According to a disclosure from the security firm SlowMist, the company recently received multiple reports of users' assets being stolen. Its investigation found that the affected cases involved private-key exposure. Additionally, these users had installed or once installed the FomoPeek application. FomoPeek is not itself a cryptocurrency wallet but a tool that helps users watch and track the movement of on-chain funds.

WaterPlum, a North Korean hacking group, compromised at least 30,000 devices in more than 100 countries and sent over $10.7 million in stolen cryptocurrency to North Korea. The campaign used fake interviews, malicious coding tests, and recruiter impersonation to spread malware and steal credentials, wallet data, and identity documents. #WaterPlum #ContagiousInterview #BeaverTail #InvisibleFerret #OtterCookie #OtterCandy #StoatWaffle #DPRK

At a Glance Malware type Browser-injected web skimmer Threat actor Unattributed; linked to "The Protocol One" persona Targets Crypto traders using SwapZone and SimpleSwap Delivery vector ClickFix-style lures on Telegram, DarkForums, paste sites Key capabilities Google Sheets C2, address swapping, clipboard hijacking Source Cisco Talos TL;DR Cisco Talos uncovered a crypto-stealing campaign that turns the ClickFix browser attack into a web skimmer.

A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. "The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment

At a Glance Malware family: FUNNULL-hosted iOS spyware Threat actor: Suspected Vietnamese-operated group Targets or victims: Mobile visitors to Vietnamese streaming sites Delivery vector: Trojanized Composer themes Key capabilities: WebKit-to-kernel exploit, crypto wallet theft, ad-fraud Source: Socket Threat Research Team TL;DR Thirteen malicious Composer packages inject JavaScript into movie streaming websites. This code delivers Packagist themes iOS spyware to unpatched iPhones.

The Sality botnet silently swapped copied wallet addresses for eight years. Authorities cut off more than 15,000 infected machines this week.

At a Glance Actor / group Unnamed financially motivated actor; assessed as a likely single operator Activity type Initial-access operation, RMM abuse, credential and crypto theft Targets / victims Windows hosts; console listed 324 hosts, 69 reporting online Scale 324 listed hosts across one management console Attribution status No named actor; no public law-enforcement action reported Source

BTCPay Server has temporarily blocked public remote access to Lightning Network nodes after attackers exploited a critical vulnerability to steal macaroon credentials and drain funds. At least two operators — Foundation and Citadel21 — reported losses, though the total stolen amount remains unknown.

AI-powered phishing is evolving, crafting hyper-realistic scams that target Web3 users. Learn how these sophisticated attacks work and pragmatic strategies to protect your digital assets from this growing threat.

At a glance

Recently, we covered the critical security failure in the Canadian hardware wallet COLDCARD. A flawed random-number algorithm generated predictable seeds, and attackers rebuilt the faulty generator to derive private keys and sweep matching wallets. The damage has since widened considerably. Three Waves, 4,585 Wallets, $88.6 Million The on-chain analysis team Galaxy Research has been tracking Bitcoin transfers linked to the COLDCARD flaw.