Fake IT Job Interviews Used by North Korean Hackers to Steal Millions in Crypto

Law enforcement agencies from Japan, the United States, Australia and Germany have warned that a North Korean‑backed hacking group, known as Waterplum (also called Contagious Interview), used fake technology recruitment interviews to distribute malware worldwide.

How the campaign operated

Targets were approached on job platforms and social media, posing as recruiters for AI, blockchain and other tech firms. During supposed technical interviews or coding assessments, candidates were asked to download files presented as coding tests or video‑conference troubleshooting tools. The files contained backdoor trojans and information‑stealing malware that harvested personal documents and cryptocurrency private keys.

Scale of the compromise

• More than 30,000 devices in at least 100 countries were infected between December 2025 and July 2026.
• Over 7,000 cryptocurrency wallets were accessed.
• Approximately 1.7 billion yen (about $10.71 million) in digital assets were transferred to wallets controlled by North Korean actors.

Domestic enablers and “laptop farms”

Japanese authorities uncovered a local operation that allowed North Korean workers to use Japanese and U.S. IP addresses, facilitating the remote execution of the campaign. The seized “laptop farm” was used to route hundreds of millions of yen worth of crypto assets overseas.

Security recommendations

International agencies advise tech companies and gig workers to:

1. Run any downloaded code in isolated sandbox environments.
2. Avoid executing unverified software during online interviews.
3. Implement workspace restriction controls for untrusted code repositories.