Fake Tech Interviews Helped North Korea Infect 30,000 Devices

A multinational advisory says North Korean hackers used bogus coding tests to compromise jobseekers in more than 100 countries, steal cryptocurrency and harvest identities for further fraud.

North Korean hackers infected at least 30,000 computers by posing as employers and sending software developers malicious coding tests, according to a new advisory from agencies in Japan, the United States, Australia and Germany.¹

The campaign, known as WaterPlum or Contagious Interview, compromised more than 7,000 cryptocurrency wallets and transferred at least ¥1.7bn ($10.71m) in cryptocurrency to North Korea, the agencies said.¹

The victims were targeted through social media, job boards, freelance marketplaces and recruiting services across more than 100 countries.¹
Applicants were told to download coding assignments, troubleshoot video software or open developer projects containing malware.¹
The attackers stole wallet credentials, browser passwords, keystrokes, screenshots, identity documents and other files — not just cryptocurrency.¹
The FBI and Japan’s National Police Agency assess that WaterPlum operators and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department.¹
Infected devices could later provide a route into companies where victims found legitimate work, exposing corporate systems, source code and trade secrets.¹

The technical trick was simple enough to pass as ordinary recruitment. Malicious packages were embedded in NPM projects and other developer files, including projects designed to trigger code when opened in Visual Studio Code. The malware could install remote-access tools, maintain a foothold and send stolen information to an external command-and-control server.¹

The campaign also shows why North Korea’s fake-worker operations are more dangerous than a hiring scam. The same machinery can steal from an individual applicant, impersonate them with copied identity documents, and potentially move into the networks of a future employer. Japanese investigators separately dismantled a “laptop farm” used to let North Korean workers remotely control employment computers and funnel money abroad.¹

The advisory does not say that every one of the more than 7,000 affected wallets was emptied. Its wording covers wallets from which either funds or account credentials were taken. But it does put a firm lower bound on the cryptocurrency traced to North Korea: $10.71m.

The agencies observed operators using AI face-swapping during interviews, machine translation and text-to-speech tools. Their warning to developers is blunt: do not run untrusted code on machines holding cryptocurrency or personal data, and treat a compromised device as breached even after the malware appears to have been removed.¹

Joint advisory from the FBI, Japan’s National Police Agency, Japan’s National Cybersecurity Office, Australia’s Australian Signals Directorate, Germany’s Federal Intelligence Service and Germany’s Federal Office for the Protection of the Constitution ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰

Fake Tech Interviews Helped North Korea Infect 30,000 Devices

Footnotes