Threat Intel
WaterPlum Infected 30,000 Devices via Job‑Seeking Phishing, Stole $10.7M in Crypto
From December 2025 to July 2026, the North Korean group WaterPlum compromised over 30,000 devices worldwide, siphoning more than $10.7 million in cryptocurrency. The campaign, part of the “Contagious Interview” effort, lured job seekers with malicious npm packages and fake interview prompts. Defenders should vet third‑party code, monitor npm traffic, and enforce application whitelisting.
What Happened
WaterPlum, a North Korean threat actor, infected at least 30,000 endpoints across 100+ countries between December 2025 and July 2026. The group used a “Contagious Interview” campaign that delivered malware through malicious npm packages and fake interview scenarios, then transferred over $10.7 million in stolen cryptocurrency to North Korea.
Impact
Victims were primarily job seekers and developers who downloaded malicious code during supposed coding tests or video‑conference troubleshooting. The malware exfiltrated credentials and other sensitive data, enabling further lateral movement and financial theft.
How to Defend
- Verify all npm packages against trusted registries and use package‑integrity checks.
- Block or quarantine downloads from unknown or unverified sources, especially during onboarding or interview processes.
- Implement application whitelisting and endpoint detection & response (EDR) to detect anomalous execution of npm scripts.
- Monitor outbound cryptocurrency transactions and flag large transfers to known North Korean wallets.
- Educate staff on phishing indicators and safe coding practices.
Mitigation Steps
Use npm audit, lockfile verification, and signed packages. Deploy web filtering to block malicious domains and enforce least‑privilege execution for development tools.
Related articles
Mac Malware Uses Fake CAPTCHA to Steal Keychain Credentials and Drain Crypto Wallets
A Go‑based malware delivered via a ClickFix phishing scam infected macOS systems by executing a terminal command. The payload extracts Keychain passwords and drains cryptocurrency wallets. Defenders should block the malicious domain, update EDR signatures, and audit Keychain access logs.
Read briefing
Operation Dream Job: From Job Offers to Zero‑Day Attacks on Defense Sectors
Check Point Research has traced a fresh wave of the Operation Dream Job campaign, a Lazarus‑linked effort that turns enticing job ads into a multi‑stage breach. The attackers now use a trojanized PDF viewer, the SecurityPDF app, to deliver a new kernel‑mode rootkit (FudModule) via the zero‑day CVE‑2026‑68820 in Microsoft’s AFD.sys driver. They also weaponize CVE‑2025‑49113 in Roundcube to plant RelayShell webshells, turning compromised servers into covert C2 relays. The campaign targets aerospace, aviation and defense firms worldwide, leveraging spear‑phishing, SEO‑boosted fake recruitment sit
Read briefing
Mirage Kitten APT Deploys NodeRabbit and PollCat RATs via Trojanized Coding Challenges
Kaspersky researchers have uncovered new campaigns by the Mirage Kitten threat group targeting aviation and FinTech sectors in the Middle East and Africa. The attacks utilize two previously undocumented cross-platform remote access trojans, NodeRabbit and PollCat, delivered via malicious job application coding challenges.
Read briefing
Brevo Email Platform Breach Sparks Targeted Phishing of Crypto Firms
A flaw in Brevo’s SAML SSO allowed attackers to access 138 customer accounts, some of which were used to send phishing emails to subscribers of major crypto companies. Trezor, CoinTracking, and BitBox confirmed attacks, and defenders must verify email authenticity, audit third‑party services, and monitor for abnormal activity.
Read briefing