A joint advisory from U.S., Japanese, Australian, and German authorities puts hard numbers behind a campaign defenders have been watching for years: North Korea-linked WaterPlum, also known as Contagious Interview, has reportedly infected at least 30,000 devices across more than 100 countries and helped move more than $10.7 million in cryptocurrency to DPRK-linked actors.

The public reporting from BleepingComputer, based on the joint law enforcement advisory, describes a campaign that blends social engineering, developer tooling abuse, malware delivery, cryptocurrency theft, and fraudulent remote IT work. For small businesses and government contractors, the important lesson is not just “watch out for fake recruiters.” It is that hiring, contractor onboarding, developer workstations, and source-code access now sit inside the same attack surface.

What WaterPlum is doing

WaterPlum operators pose as recruiters, employers, or technical interviewers, often impersonating AI, cryptocurrency, NFT, or software companies. Targets are pushed through fake interviews, coding assessments, troubleshooting steps, or repository-based projects that require them to run code. That code can deliver malware instead of a legitimate test project.

The advisory ties the activity to malware families including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle. The common thread is practical credential and access theft: browser secrets, clipboard contents, screenshots, keystrokes, documents, cryptocurrency seed phrases, and developer environment access. In some cases, the infected machine is not the final objective. It is the first step toward an employer, client, codebase, or cloud environment.

Why this matters to SMBs and government contractors

Many smaller organizations treat recruiting, freelance work, and coding tests as normal business operations rather than security-sensitive workflows. That gap is exactly what campaigns like Contagious Interview exploit. A developer may be careful with production systems but still run a “test project” locally during a job hunt. A contractor may be legitimate but bring a previously compromised laptop into a client environment. A hiring manager may validate technical skill while never validating identity, geography, device posture, or least-privilege access.

For government contractors, the risk is sharper. Source code, proposal material, CUI-adjacent data, internal credentials, VPN access, cloud consoles, and customer environments can all be exposed from one trusted developer workstation. Even when no classified information is involved, a compromised contractor endpoint can create incident reporting obligations, customer confidence problems, and evidence gaps during an audit.

Defensive takeaways

  • Run interview code in disposable environments. Coding tests from unknown parties should execute only in a VM, sandbox, cloud dev environment, or isolated throwaway machine. Never run them on a workstation that holds browser sessions, SSH keys, cloud tokens, customer data, or wallet material.
  • Treat VS Code project trust as a control. Unknown repositories should open in Restricted Mode. Inspect .vscode/tasks.json, package scripts, install hooks, build steps, and commands that fetch or decode secondary payloads.
  • Separate job-search activity from production work. Developers and admins should not conduct external interviews, freelance screening, or crypto activity from the same profile used for company systems.
  • Verify remote workers before granting access. Validate identity, location, payment details, interview consistency, and IP/geolocation anomalies before issuing accounts. Re-verify when behavior changes.
  • Limit contractor blast radius. Use just-in-time access, separate accounts, device posture checks, monitored VPN access, repository-level permissions, and fast offboarding.
  • Monitor for developer-workstation compromise. Watch for unusual package execution, suspicious child processes from IDEs, credential-dumping behavior, unexpected outbound tunnels, and new persistence from user-writable paths.

Bulwark Black assessment

WaterPlum is a reminder that developer security is no longer limited to dependency scanning and secure coding. The developer workstation is now an identity hub, build node, secrets cache, cloud control plane, and recruiting endpoint. If a threat actor can convince a developer to run one malicious project, they may inherit access far beyond that laptop.

The proper response is not to stop hiring remotely or stop using contractors. The response is to make hiring and onboarding resilient to compromise: verify people, isolate code execution, restrict initial access, and assume unknown projects are hostile until proven otherwise. For lean teams, that discipline is cheaper than cleaning up a stolen-token incident after the attacker has already reached source code, customer systems, or cloud infrastructure.

Original source: BleepingComputer — North Korean WaterPlum hackers infected 30,000 devices worldwide. Additional source: Joint cybersecurity advisory PDF.