North Korean Hackers Targeted IT Professionals with Fake Job Listings and Stole Data from 7,000 Crypto Wallets

• North Korean hackers used fake job postings to steal cryptocurrency.
• They infected 30,000 devices and stole data from 7,000 crypto wallets.
• Specialists from more than 100 countries were among the victims.

Japan’s National Police Agency (NPA), together with the U.S. FBI, as well as Australian and German law enforcement agencies, uncovered the activities of the North Korea-linked cyber group WaterPlum. According to the agencies, from December 2025 to July 2026, the group infected more than 30,000 devices across more than 100 countries and regions with malware and stole data from more than 7,000 cryptocurrency wallets. 

Crypto assets worth at least 1.7 billion Japanese yen, or about $10.8 million, were transferred to wallets controlled by WaterPlum.

WaterPlum Disguised Attacks as Job Postings

The group’s primary targets were IT professionals, including web developers, engineers, and specialists in cryptocurrency, blockchain, and Web3. WaterPlum posed as legitimate AI, crypto, and NFT companies or recruiting services and offered candidates attractive job openings.

During interviews or while completing test assignments, victims were asked to download malicious programs from collaboration platforms or code repositories. To distribute malware, the group used, among other things, NPM packages into which it embedded the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle families.