Job hunting usually comes with the usual worries, getting shortlisted, preparing for interviews, and completing coding tests. But for thousands of IT professionals, a seemingly genuine job opportunity has become the entry point for a sophisticated cyberattack.
A North Korean-linked threat actor known as WaterPlum, also tracked under the name Contagious Interview, has compromised more than 30,000 devices across over 100 countries and stolen at least $10.71 million in cryptocurrency from more than 7,000 wallets, according to a joint advisory from cybersecurity agencies in the U.S., Japan, Australia and Germany.
The campaign primarily targets software developers, web designers, engineers and professionals working in cryptocurrency, blockchain and Web3. Attackers pose as recruiters or prospective employers, often impersonating legitimate AI, crypto, or NFT companies. They then invite candidates to a technical interview or coding assessment.
That is where the trap is set. Victims may be asked to download a project, install an NPM package, or troubleshoot a supposed technical problem. The files, however, contain malware such as BeaverTail, InvisibleFerret, OtterCookie, and StoatWaffle. Once executed, the malware can establish backdoor access and deploy Remote Access Trojans (RATs), allowing attackers to maintain persistence and move deeper into compromised systems.
The attackers can then harvest browser credentials, keystrokes, screenshots, clipboard data, cryptocurrency wallet information, private keys, and seed phrases. But the danger doesn’t necessarily end with the individual victim.
A compromised developer’s computer can become a stepping stone into the company that eventually hires them, creating opportunities for corporate espionage, credential theft, intellectual-property theft, and lateral movement.
The campaign was active from at least December 2025 through July 2026, demonstrating how cybercriminals are turning everyday digital processes, like recruitment and coding assessments, into attack surfaces.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
