WaterPlum ("Contagious Interview"): a seven-agency joint advisory quantifies the DPRK fake-job campaign for the first time, 30,000+ devices, 100+ countries, $10.7M in crypto, and Japan's first dismantled "laptop farm"

Seven government agencies (Japan's National Police Agency and National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND and BfV) jointly published a Cybersecurity Advisory on 2026-09-18 on the North Korean "WaterPlum" cyber-actor group, publicly known as Contagious Interview and already tracked here under that name (FBI/IC3, 2026-09-18). The advisory is the first to attach concrete scale to the campaign: at least 30,000 infected devices across more than 100 countries, funds or credentials exfiltrated from over 7,000 cryptocurrency wallets, and roughly 1.7 billion Japanese yen (about USD 10.7 million) moved to DPRK (FBI/IC3, 2026-09-18). Germany's BfV confirms the campaign has targeted software developers "also in Germany" (translated from German) (Bundesamt für Verfassungsschutz, 2026-09-18).

WaterPlum poses as recruiters, frequently impersonating AI, cryptocurrency or NFT companies, and also using legitimate freelance and recruiting platforms, to lure software developers and IT professionals into a technical interview or take-home coding assignment; victims are told to download and run files hosted on collaboration platforms and code repositories to "complete a coding assignment or troubleshoot an error." Those files carry one of five malware families the advisory names for the first time together: BeaverTail (a JavaScript loader hidden in NPM packages hosted on GitHub or Bitbucket), InvisibleFerret (a Python backdoor), OtterCookie (a JavaScript RAT and infostealer, already tracked here from Elastic's 2026-07-18 SVG-steganography disclosure), OtterCandy (combining OtterCookie and RATatouille features), and StoatWaffle, a modular Node.js loader, credential harvester and RAT that hides inside blockchain-themed decoy VS Code project repositories and auto-executes through a malicious VS Code configuration file the moment the victim opens and trusts the folder (FBI/IC3, 2026-09-18). Once backdoored, operators use the RATs for persistence and lateral pivoting while infostealers harvest browser-stored credentials, clipboard contents, keystrokes, screenshots and cryptocurrency-wallet data to a command-and-control address; the same access lets operators pursue further espionage or intellectual-property theft inside the victim's employer.

The advisory ties the malware-delivery operation to North Korea's separate, long-running remote-IT-worker placement scheme (tracked here as PurpleDelta / Jasper Sleet / UNC5267 / Wagemole / Famous Chollima): "the NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea" (FBI/IC3, 2026-09-18); the two operations share a parent organization even though they run distinct tradecraft. Separately, Japanese authorities disclosed "for the first time in Japan" a dismantled "laptop farm" (a facility where an enabler physically hosted employer-issued laptops and remotely operated them on North Korean workers' behalf) moving "several hundred million" yen in cryptocurrency abroad (FBI/IC3, 2026-09-18). The advisory records two prior cases of IT-worker escalation beyond simple wage fraud: one worker extorted an employer over its own source code after a payment dispute, and another defaced and disabled a hiring company's website.

Triage: BeaverTail/InvisibleFerret/OtterCookie-family execution shows up as a node or python process spawned from an IDE or terminal session shortly after a new project folder is opened or an npm install completes, followed by outbound connections to non-corporate destinations and API calls against browser credential stores or the clipboard; legitimate build tooling does not read browser credential stores or poll the clipboard. StoatWaffle's variant of the same pattern is a VS Code auto-run entry (a .vscode configuration file) firing on folder-open/trust in a freshly cloned, blockchain-themed repository the organization's own ticketing has no record of. The distinguishing context, in both cases, is timing correlation with an active job-interview or coding-test process rather than the presence of node/npm/VS Code activity alone.