WaterPlum is a North Korean threat actor linked to a multi-year campaign called "Contagious Interview," which targets job seekers via malicious npm packages and fake interviews. The group infected at least 30,000 devices in over 100 countries and stole funds from more than 7,000 cryptocurrency wallets, transferring approximately $10.7 million to North Korea. WaterPlum uses several malware families, including BeaverTail (JavaScript malware in npm packages), InvisibleFerret (Python backdoor), OtterCookie (JavaScript RAT and info stealer), OtterCandy (combined RAT), and StoatWaffle (modular Node.js malware). The malware steals browser credentials, clipboard data, keystrokes, cryptocurrency private keys, seed phrases, and documents, and captures screenshots. WaterPlum actors also pivot to employer or client networks for intellectual property theft and espionage. The group is connected to North Korean IT workers who perform remote web development and reuse stolen identities. The FBI and Japanese police attribute WaterPlum operations to North Korea's 313 General Bureau under the Munitions Industry Department.

WaterPlum's operations have resulted in the compromise of at least 30,000 devices globally, theft of credentials and cryptocurrency private keys from over 7,000 wallets, and the transfer of approximately $10.7 million in stolen cryptocurrency to North Korea. The malware enables extensive data theft, including sensitive documents and keystrokes, and facilitates lateral movement into employer or client networks, potentially leading to intellectual property theft and espionage. The group's activities support North Korea's weapons programs by generating revenue through cybercrime.

The advisory recommends companies carefully verify job applicants' identities, locations, and qualifications, and restrict their access to only necessary systems and data. Developers should avoid running unknown code outside sandboxed environments and thoroughly inspect files and code for commands that fetch additional payloads. There is no indication that the threat is mitigated or patched; organizations should apply these operational security measures to reduce risk.