WaterPlum advisory cites at least 30,000 compromised devices

A joint advisory puts the scope at more than 100 countries

The advisory from Japanese, US, Australian, and German authorities attributes a multi-year campaign known as Contagious Interview to WaterPlum. It says attackers impersonated AI, cryptocurrency, and NFT companies or used recruiting platforms to induce job seekers to run malicious code. The advisory says the group compromised at least 30,000 devices in more than 100 countries, took funds or account credentials from more than 7,000 cryptocurrency wallets, and transferred cryptocurrency valued at over $10.7 million to North Korea.

The campaign had previously been described as targeting job seekers through malicious npm packages used in fake interviews and coding tests.

A joint law-enforcement advisory has now put a numerical scope on the campaign: at least 30,000 compromised devices in more than 100 countries between December 2025 and July 2026, according to the report.

The reported tally connects recruitment-themed malware activity with a large multi-country device count and cryptocurrency losses. It also describes a route from compromised job seekers' computers into their employers' or clients' networks.