WaterPlum fake interviews linked to more than 30,000 compromised devices

Malware delivered through supposed recruitment tests

The advisory reportedly attributes the campaign to North Korean operators posing as recruiters targeting web designers, engineers, and cryptocurrency and Web3 specialists. Victims were instructed to download purported interview assignments; opening them allegedly installed malware, including remote-access trojans and information stealers. The agencies said the activity also compromised more than 7,000 cryptocurrency wallets and attributed at least $10.71 million in thefts to the tactics.

Jobseekers were reportedly presented files framed as coding assignments or other recruitment tests during purported interviews.

According to an international advisory, opening those files led to malware infections on more than 30,000 devices, alongside compromises of more than 7,000 cryptocurrency wallets and at least $10.71 million in attributed thefts.

The reported scheme uses a routine hiring step as the delivery mechanism for persistent access to credentials and sensitive data. The advisory also warns that compromised applicants who later obtain legitimate jobs could provide a route into corporate systems.