Japan NPA and FBI Expose North Korean Hacker Group Using Fake Job Offers to Steal Crypto Assets

Original source: npa.go.jp

Compiled by Odaily Planet Daily (@OdailyChina); Translator | Asher (@Asher_0210)

On September 18, multiple agencies including Japan's National Police Agency and the U.S. Federal Bureau of Investigation jointly disclosed that the North Korean hacking group WaterPlum (also known as "Contagious Interview") has long impersonated recruiters or cryptocurrency companies to lure developers into running malicious code under the guise of programming tests and project collaboration.

From December 2025 to July 2026, the organization infected over 30,000 devices in more than 100 countries, transferring funds or stealing account credentials from over 7,000 cryptocurrency wallets, involving at least $10.71 million in crypto assets.

Unlike past attacks that primarily targeted exchanges and large institutions, WaterPlum has further expanded its focus to individual developers, freelancers, and Web3 professionals. Attackers not only directly steal wallet assets but also use compromised computers and identity information to infiltrate the victims’ companies, paving the way for subsequent theft of trade secrets, extortion, or even impersonation of the victims in job applications.

The most common entry point for WaterPlum attacks is not phishing emails, but a seemingly legitimate job opportunity. Attackers impersonate AI, cryptocurrency, or NFT companies, reaching out to software developers via social media, online job platforms, gig platforms, and freelance marketplaces. After initial contact, they typically schedule an online video interview or ask candidates to complete a programming test.

The real attack occurs during the "technical assessment" phase. Attackers may send job candidates a code repository, asking them to run the project locally, fix bugs, or troubleshoot issues with video conferencing software. These projects appear to be ordinary JavaScript, Python, or VS Code projects, but internally contain malicious code.

WaterPlum frequently uses NPM packages (Node.js package manager) infected with malicious code, involving multiple malware families such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle. Some of these malicious projects exploit the .vscode/tasks.json configuration file to automatically execute code after users open and trust a VS Code folder. For victims, the entire process may simply involve downloading code, opening the project, and running the program as instructed by the "interviewer," while the malware quietly installs itself in the background.

After gaining initial access, attackers deploy remote access trojans to maintain long-term control over the device and use information-stealing programs to collect data. Primary targets include:

• Account and password saved in the browser;
• Clipboard content, keyboard input records, and screenshots;
• Cryptocurrency wallet private keys, recovery phrases, and related data;
• Files on your computer and shared folders;
• Photos of identification documents such as driver’s licenses and passports.

This information will ultimately be sent to a server controlled by the attacker. Even if the victim’s wallet contains no assets at the time, as long as the private key or mnemonic phrase has been compromised, the attacker can monitor the address long-term and transfer funds as soon as they arrive.

Once a device is compromised, the risks extend beyond personal wallets. Developers typically have access to company code repositories, cloud services, and internal systems. WaterPlum could exploit login credentials and existing permissions stored on the device to infiltrate the employer’s, clients’, or partners’ systems, continuing to steal trade secrets, move laterally within corporate networks, or even leverage sensitive data for extortion.

Stolen driver’s licenses, passports, and other identity documents obtained by WaterPlum have another use: they are handed over to North Korean IT personnel who impersonate the victims to apply for jobs overseas and earn foreign currency. WaterPlum primarily distributes malware through fake job postings, while North Korean IT personnel pose as overseas developers to infiltrate companies; there is overlap in both personnel and infrastructure between the two groups. Japan’s National Police Agency and the FBI have determined that members of WaterPlum and certain North Korean IT personnel are affiliated with the 313th Bureau of the Military Industry Department under the Central Committee of the Workers’ Party of Korea.

To circumvent corporate verification of employee identity and work location, North Korean IT personnel collaborate with overseas intermediaries who set up work computers at local residences, provide identity information, and collect salaries on their behalf, while the actual work is performed remotely by individuals located in North Korea, Russia, and other regions—effectively serving as remote work hubs that mask the true location and identity of the operators.

Using this model, North Korean IT workers can log into corporate systems using local computers and networks in Japan or the United States, making companies believe the employees are physically present there. The individuals assisting them also receive the company-issued computers, provide identification documents and bank accounts, and then transfer the received salaries to the actual workers.

This is the first time Japanese authorities have uncovered such a facility within Japan. The investigation found that the individuals involved not only helped North Korean IT personnel disguise their identities and secure work, but also transferred tens of millions of yen in funds overseas, including cryptocurrency assets. The notice warns that businesses or individuals who provide work, make payments to North Korean IT personnel, or assist them with identity information, bank accounts, or remote devices may violate local laws and breach sanctions against North Korea.

The risks these individuals bring to the company extend beyond wages flowing to North Korea. One North Korean IT worker extorted their employer over a pay dispute and publicly released the company’s proprietary source code; another individual hired to maintain the website maliciously altered it, causing the site to become inaccessible.

Cryptocurrency companies are one of the key industries targeted by North Korean IT personnel.

In May 2025, a Japanese cryptocurrency exchange received a job application for an engineering position from a candidate suspected to be a North Korean IT worker, who accessed the job posting via a VPN and submitted a forged resume. The resume appeared exceptionally well-rounded: the applicant claimed proficiency in numerous programming languages, blockchain technologies, cryptocurrency systems, and cloud services, listing over ten related skills and experiences in each category. The personal background included education at European universities and employment experience across multiple cities in Europe and Asia within a short timeframe. During the video interview, the applicant claimed to have been born in Malaysia and residing in Finland, with Malay and Chinese as native languages. However, their English proficiency was clearly inconsistent with the claimed educational and professional background—they could only answer basic questions and were unable to provide detailed explanations for most of the technical skills listed on the resume.

The notice also summarized common characteristics observed among other suspected North Korean IT personnel during interviews, including refusing in-person meetings, demanding payment in cryptocurrency, frequently glancing at another screen, occasional voices of others audible in the background, and repeated buffering in video or audio. Frequent glances at another screen may indicate that the applicant is reading answers provided by someone else; even if only one candidate appears on screen, multiple individuals may be collaborating behind the scenes to fabricate the technical skills listed on the resume.

Even if your wallet assets have not been transferred yet, running untrusted code on your computer does not mean your device or wallet is still secure. Malware may have already obtained your private key, seed phrase, or browser login credentials, but is simply not acting immediately. Attackers may also maintain a backdoor on your device, waiting for a more opportune time to initiate a transfer.

Multiple international institutions recommend not running code provided by strangers directly on devices that store cryptocurrency assets or handle sensitive data. If testing is necessary, use a sandbox or virtual machine isolated from your daily environment, and inspect the project for obfuscated, unreadable, or auto-downloading code before execution.

Be especially cautious with scripts containing curl, base64, mshta, Invoke-WebRequest, or other commands used for downloading, encoding, or concealing execution—do not run them unless you fully understand their purpose. If your device has been flagged by antivirus software as infected, or if you previously ran a program provided by a suspicious employer, immediately disconnect from the network. Even if the malware is later removed, assume your wallet data has been compromised: create a brand-new wallet on a separate, secure device, transfer all assets to it, and store the new mnemonic phrase offline.

Due to potential undiscovered backdoors still present on the infected computer, the safest approach is to back up essential data and then completely reinstall or reset the operating system, rather than continuing to use the existing environment.