North Korea's Fake Job Interviews Ran For Eight Months
The Interview That Wasn't
WaterPlum, the group North Korea's 313 General Bureau runs under its Munitions Industry Department, began posting job openings in December 2025 for artificial intelligence, cryptocurrency and NFT roles that promised remote work and paid in the currency the applicant already trusted. The roles did not exist, or existed at companies that never posted them. The interview process ended the way legitimate technical interviews do: with a coding test, sent as a take-home assignment with a repository to clone and run locally. The test was the payload. Candidates who ran it were executing one of five malware families dressed as a homework assignment: BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle. Some harvested browser credentials and crypto wallet keys directly. Some installed quietly and waited for persistent access later. None of it announced itself, because none of it needed to. Over eight months, the campaign reached more than 30,000 devices across over 100 countries and drained more than 7,000 cryptocurrency wallets for a combined $10.71 million, a figure reported by BleepingComputer and The Record. No corporate perimeter was breached in the conventional sense. The applicants breached themselves, on request, as a condition of getting hired.
The Money Trail
Japan's National Police Agency was not chasing WaterPlum's malware. It was chasing the money the malware generated, and tracing wallet flows backward led investigators somewhere the campaign itself never touched: the country's first identified North Korean IT worker 'laptop farm,' a facility that let an overseas operator appear to be logging in from inside Japan while drawing a domestic salary for work a foreign operator was actually doing. NPA traced several hundred million yen moved overseas through the arrangement, a separate scheme from WaterPlum's wallet drains but funding the same institution. On September 18 and 19, 2026, Japan's National Police Agency and National Cybersecurity Office published a joint advisory with the FBI and the US Defense Department's Cyber Crime Center, Australia's Cyber Security Centre, and Germany's foreign and domestic intelligence services, naming all five malware families and attributing the operation to North Korea. Four countries publishing one advisory together is rare enough to notice on its own. It is also, functionally, a confirmation notice for a case investigators had already spent eight months quietly building. The laptop farm bust and the WaterPlum attribution landing in the same 48 hours was not a coincidence. They are the same file, opened from two different ends of the same transaction.
The Ninety-Eight Percent
Researchers cited by The Register put North Korea's total fake IT worker fraud economy at roughly $500 million a year. WaterPlum's confirmed haul across eight months and four governments' worth of investigative effort, $10.71 million, is a little over two percent of that figure. The advisory closes one vein: a named malware set, a dismantled laptop farm, $10.71 million that Tokyo, Washington, Canberra and Berlin could all stand behind in print at the same time. It says nothing about the remaining 98 percent, which by definition has not been caught, traced, or named in any advisory yet. The people who feel this are not incident responders. They are the founders and recruiters at seed-stage AI and crypto startups running their own hiring off LinkedIn, without a background-check vendor on retainer, sending a take-home coding test to a resume that looks right because the hiring bar for scarce technical talent is speed, not scrutiny (a background check costs a week the market has already decided it doesn't have). Anti-money-laundering controls built to catch a fraudulent transaction were never built to catch a fraudulent applicant. No dashboard tile currently flags a coding-test download as a compromise event, because nobody wired one to.
WaterPlum's file closes at $10.71 million and one dismantled laptop farm, both numbers four governments will now stand behind. Neither is the size of the problem. It is the size of the piece investigators could trace backward through withdrawn wallets in eight months. The laptop farm case is now moving through Japanese authorities, the first test of whether this file leads to anyone doing time.
Sources
- North Korean Hackers Infect Thousands Of Devices Across 100 Countries (therecord.media)
- North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide (bleepingcomputer.com)
- North Korea WaterPlum Job-Seeker Crypto Attacks (cyberscoop.com)
- Researchers Lift The Lid On North Korean IT Worker Fraud Scale (theregister.com)