Contagious Interview Campaign Spreads Malware Through Fake Tech Jobs

A North Korea-linked cyber operation known as WaterPlum, widely tracked as Contagious Interview, has compromised at least 30,000 devices across more than 100 countries by targeting IT professionals with fraudulent recruitment opportunities.


The campaign primarily targets software developers, freelancers and cryptocurrency professionals. Authorities have also linked the operation to more than 7,000 compromised cryptocurrency wallets and approximately JPY 1.7 billion ($10.71 million) in stolen digital assets.


Fake Interviews Deliver Malicious Code

WaterPlum operators impersonate recruiters and representatives of technology, AI, cryptocurrency and NFT companies. Victims are approached through employment platforms, social networks and freelance marketplaces before being invited to interviews or coding assessments.


Candidates may then receive malicious repositories or software presented as legitimate programming tests. Because developers routinely download source code and install dependencies during technical assessments, the approach can make malicious activity difficult to recognize.


Attackers have also reportedly used AI-powered face-swapping during video interviews to make fraudulent recruiter identities appear more convincing.


WaterPlum Deploys Multiple Malware Families

The operation uses several malware families to steal information and maintain access to compromised systems.


BeaverTail and InvisibleFerret

BeaverTail is JavaScript-based malware that has been distributed through malicious npm packages, while InvisibleFerret provides Python-based backdoor capabilities for continued access to infected devices.


OtterCookie, OtterCandy and StoatWaffle

OtterCookie combines remote-access and information-stealing capabilities, while OtterCandy incorporates functionality associated with other WaterPlum tools.


Another malware family, StoatWaffle, can abuse Microsoft Visual Studio Code projects. Malicious configuration files can execute attacker-controlled commands after a developer opens and trusts a compromised repository.


Credentials and Crypto Wallets at Risk

Following infection, WaterPlum malware can collect browser credentials, cookies, clipboard information, screenshots, keystrokes and locally stored files.


Cryptocurrency users face additional risks because attackers may attempt to steal wallet private keys and seed phrases.


Compromised developer machines can also expose corporate credentials and authentication tokens, potentially giving attackers opportunities to move deeper into organizational networks.


Developers Urged to Isolate Interview Projects

Developers should avoid running unfamiliar recruitment projects on primary workstations, particularly devices containing cryptocurrency wallets or privileged corporate credentials.


Suspicious repositories should instead be examined inside isolated virtual machines or sandbox environments. Visual Studio Code users should keep unfamiliar projects in Restricted Mode until configuration files, including files inside.vscodedirectories, have been reviewed.


Anyone who believes they executed a malicious recruitment project should isolate the affected device, rotate credentials from a clean system and invalidate exposed sessions. Cryptocurrency assets should also be moved to a newly created wallet if private keys or seed phrases may have been exposed.


WaterPlum demonstrates how North Korean operators are exploiting routine developer workflows, turning seemingly legitimate job interviews and coding assessments into an effective route for malware delivery, credential theft and cryptocurrency compromise.