WaterPlum fake-recruiter scam hit 30,000 devices, allies warn

On 18 September 2026, cybersecurity and law-enforcement agencies from the United States, Japan, Australia and Germany published a joint advisory attributing a wave of fake-recruiter attacks to WaterPlum, a North Korea-linked group more widely known in the security industry as "Contagious Interview." The advisory says the campaign, running from around December 2025 through July 2026, compromised roughly 30,000 devices across more than 100 countries.

How the campaign works

WaterPlum operators pose as recruiters for AI, cryptocurrency or NFT companies, approaching software developers and IT professionals through social media, job boards and freelance marketplaces. After a technical interview or coding test is set up, candidates are told to download a project or a "fix" for a call issue — files that in fact deliver malware once run. The advisory ties the group to more than 7,000 compromised cryptocurrency wallets and roughly $10.7 million moved to North Korea.

Why this matters for hiring, not just security teams

The campaign specifically targets the interview and onboarding stage, a part of the process most companies treat as low-risk. Agencies assess that WaterPlum operators and some North Korean IT workers who separately seek remote contracting work operate under the same military-linked organization, based partly on shared infrastructure.

Practical steps for MSPs and hiring teams

• Never run recruiter-provided code on production systems or on machines holding cryptocurrency wallets.
• Use an isolated, disposable sandbox for any take-home coding test or interview exercise.
• Enable a restricted execution mode in the editor for any untrusted workspace opened during an interview.
• Apply the same identity and payment diligence to freelancers sourced through cold outreach as to new employees.

The advisory's core value for hiring managers and engineering leads is simple: treat the interview stage itself as part of the attack surface, not a formality that happens before security controls apply.

Sources: ACSC — WaterPlum / Contagious Interview advisory, IC3/FBI — joint cybersecurity advisory (PDF).