Global Security Alert: North Korean Cybercriminals Target IT Freelancers in Multi-Million Dollar Fraud Campaign

International security agencies have issued a high-priority alert following the discovery of a sophisticated cyber-espionage and theft campaign orchestrated by North Korean-backed actors. The group, identified by researchers as "WaterPlum"—and alternatively known by the campaign name "Contagious Interview"—is reportedly posing as recruiters and hiring managers to target freelance IT professionals and software developers across the globe.

The coordinated warning comes from a coalition of security and intelligence agencies across Japan, the United States, Australia, and Germany. According to their joint findings, the operation has reached a staggering scale, successfully infecting at least 30,000 devices in more than 100 countries. The primary objective of these state-sponsored criminals appears to be two-fold: the immediate theft of digital assets and the long-term infiltration of corporate networks through legitimate-looking contractors.

To date, the group’s financial impact is estimated at $10.7 million. These funds have been largely siphoned from over 7,000 individual cryptocurrency wallets, highlighting the group’s focus on liquid digital assets alongside their broader espionage goals. As the campaign continues to evolve, authorities are urging IT workers and hiring organizations to remain exceptionally vigilant against increasingly convincing recruitment scams.

The Mechanics of the "Contagious Interview"

The WaterPlum group operates with a high degree of social engineering sophistication. Unlike traditional phishing campaigns that rely on bulk emails, this group utilizes a highly targeted approach. Victims are typically identified and recruited through legitimate professional channels, including major social media platforms, online job boards, specialized gig-work platforms, and global freelance marketplaces.

The trap is set during what appears to be a standard recruitment cycle. Prospective candidates are invited to participate in technical online virtual interviews or are asked to complete pre-employment assignments to prove their proficiency. During these interactions, the "recruiter" instructs the developer to perform a specific task, such as carrying out a coding assignment or troubleshooting a simulated error within an online video conferencing platform or a collaborative development environment.

However, these assignments are the primary delivery mechanism for malicious software. By following the instructions provided by the attackers, the developers unknowingly download and execute malicious files. These files are often hosted on reputable online collaboration platforms and public code repositories to evade basic security filters.

The technical heart of the attack involves the use of Node Package Manager (NPM) packages. These packages are embedded with a variety of malware strains, including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle, as well as several related variants. Once a developer executes the "test" code, the malware is deployed onto their local machine, granting the attackers immediate access to the system.