Global Security Alert: North Korean Cybercriminals Target IT Freelancers in Multi-Million Dollar Fraud Campaign

International security agencies have issued a high-priority alert following the discovery of a sophisticated cyber-espionage and theft campaign orchestrated by North Korean-backed actors. The group, identified by researchers as "WaterPlum"—and alternatively known by the campaign name "Contagious Interview"—is reportedly posing as recruiters and hiring managers to target freelance IT professionals and software developers across the globe.

The coordinated warning comes from a coalition of security and intelligence agencies across Japan, the United States, Australia, and Germany. According to their joint findings, the operation has reached a staggering scale, successfully infecting at least 30,000 devices in more than 100 countries. The primary objective of these state-sponsored criminals appears to be two-fold: the immediate theft of digital assets and the long-term infiltration of corporate networks through legitimate-looking contractors.

To date, the group’s financial impact is estimated at $10.7 million. These funds have been largely siphoned from over 7,000 individual cryptocurrency wallets, highlighting the group’s focus on liquid digital assets alongside their broader espionage goals. As the campaign continues to evolve, authorities are urging IT workers and hiring organizations to remain exceptionally vigilant against increasingly convincing recruitment scams.

The Mechanics of the "Contagious Interview"

The WaterPlum group operates with a high degree of social engineering sophistication. Unlike traditional phishing campaigns that rely on bulk emails, this group utilizes a highly targeted approach. Victims are typically identified and recruited through legitimate professional channels, including major social media platforms, online job boards, specialized gig-work platforms, and global freelance marketplaces.

The trap is set during what appears to be a standard recruitment cycle. Prospective candidates are invited to participate in technical online virtual interviews or are asked to complete pre-employment assignments to prove their proficiency. During these interactions, the "recruiter" instructs the developer to perform a specific task, such as carrying out a coding assignment or troubleshooting a simulated error within an online video conferencing platform or a collaborative development environment.

However, these assignments are the primary delivery mechanism for malicious software. By following the instructions provided by the attackers, the developers unknowingly download and execute malicious files. These files are often hosted on reputable online collaboration platforms and public code repositories to evade basic security filters.

The technical heart of the attack involves the use of Node Package Manager (NPM) packages. These packages are embedded with a variety of malware strains, including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle, as well as several related variants. Once a developer executes the "test" code, the malware is deployed onto their local machine, granting the attackers immediate access to the system.

Persistence and Exfiltration Strategies

The initial infection is only the beginning of the WaterPlum lifecycle. Once the malware is executed, the attackers deploy Remote-Access Trojans (RATs) to establish a foothold. These RATs are designed to maintain a constant connection with the compromised device, ensuring persistence even if the user reboots their system or changes their network settings.

These pathways allow the attackers to pivot across the victim’s systems and potentially into any corporate networks to which the developer has access. Using advanced infostealers, the group exfiltrates a wide range of sensitive data back to Command-and-Control (C2) IP addresses. These C2 servers act as the central nervous system for the operation, allowing the remote management of thousands of infected devices and networks simultaneously.

The data targeted for theft is comprehensive and designed to facilitate further financial crime or identity fraud. This includes authentication data stored in web browsers—such as usernames and passwords—as well as clipboard information, key-logs, and screenshots of the victim’s desktop. Most critically for the group’s immediate funding, the malware specifically searches for cryptocurrency wallet data, including private keys and seed phrases, which are then used to drain the victims’ funds.

Japanese authorities have emphasized that the threat extends far beyond the individual freelancer. "Beyond immediate credential theft, successful infections provide WaterPlum actors opportunities to infiltrate organizations employing targeted developers, enabling espionage, intellectual property theft, and additional lateral movement in corporate environments," the agencies warned in a joint statement. Furthermore, the stolen identity documents and images obtained through these "interviews" are repurposed by North Korean IT workers to create fake personas, allowing them to bypass international sanctions and generate foreign currency for the regime.

Another North Korean threat campaign

The investigation into WaterPlum reveals a complex logistical network supporting these cyber operations. According to the reporting agencies, while the masterminds behind the campaign are primarily based in North Korea, China, and Russia, the operational footprint extends into Africa and Southeast Asia.

One of the more alarming aspects of the group’s infrastructure is the operation of "laptop farms." These facilities are used to host and manage hardware that provides a veneer of legitimacy for fake IT workers. In these farms, attackers can simulate a local presence in a target country, making it difficult for HR departments to flag them as high-risk or fraudulent applicants.

The threat posed by these actors is not merely theoretical; the agencies cited several instances where the group’s activities escalated into direct confrontation and sabotage. In one case, the criminals extorted a company over a payment dispute and subsequently published the firm’s proprietary source code online when their demands were not met. In another incident, a North Korean operative who had successfully been hired for website maintenance used their access to deface the company’s site and render it completely inaccessible to the public.

Nick Tausek, lead security automation architect at Swimlane, noted that this campaign represents a significant expansion of the established North Korean playbook. By targeting both the hiring process and the developers themselves, the group has created a self-sustaining cycle of fraud.

"Fake IT workers seek salary income and trusted access from inside a company. WaterPlum targets legitimate applicants from the outside," Tausek explained. "Stolen credentials, source code, and identity documents can then support espionage, extortion, or new fraudulent personas. The shared laptop farms and IP addresses cited in the advisory suggest these aren’t isolated schemes. Each operation can feed the other. They can steal identities and credentials that help fraudulent workers appear legitimate. Those workers can then gain trusted access to corporate systems, opening further opportunities for theft or disruption."

Ross Filipek, CISO at Corsica Technologies, underscored the systemic risk that freelance and contract work introduces to the modern enterprise. In an era where remote work is the norm, a single compromised contractor can serve as a "Patient Zero" for a much larger corporate breach.

"One compromised workstation can expose several employers or clients without any of them being directly attacked," Filipek said. "Organizations need to know how outside developers access their environments and what information can leave through those accounts. Unknown code should be isolated before execution."

The advisory serves as a stark reminder that for North Korean cyber actors, the recruitment process is not just a way to earn a salary, but a potent vector for state-sponsored warfare and financial gain. Security agencies are advising all IT professionals to exercise extreme caution when asked to download software or run code during an interview process, particularly when the request comes from an unverified or recently created profile on a freelance platform. Organizations are likewise encouraged to implement stricter vetting processes and isolated "sandbox" environments for any technical testing of prospective hires.