The joint law enforcement advisory names WaterPlum's method plainly: 30,000 devices compromised worldwide between December 2025 and July 2026, more than $10.7 million moved out through the group's laundering chain. That is a device count, not a headcount, and the distinction matters for anyone sizing the damage. Thirty thousand infected endpoints is the kind of number that implies fake-employment schemes running at industrial scale, not a handful of operators typing fast. The advisory is joint because no single national authority could see the full device count on its own. That itself is the finding.

The mechanism is the same one this desk flagged last week: WaterPlum's fake recruiters embed inside real hiring pipelines, get developers to install tooling that turns out to be a loader, then harvest wallet credentials once the device is inside a target network. Eight months is the operational window the advisory confirms, running from December through July before four governments moved to name it. The exposure lands on two groups at once, the individual developers whose laptops became the entry point, and the employers who ran background checks on a resume rather than the toolchain a new hire was told to install. Nothing in the advisory suggests the pipeline stopped when the naming did.

The named artifact here is the advisory itself, not a single piece of malware or a CVE. No vendor product is implicated; this is a labor-market intrusion route, not a patch gap. The $10.7 million figure is confirmed transfers, not estimated scale, and the four governments involved did not disclose whether the 30,000 compromised devices have been remediated or are still beaconing. A campaign measured in device count and confirmed transfers, running eight months before four governments could agree on a name for it, is the clearest sign yet of how much runway this method still has.