Inside WaterPlum: How North Korean APT Actors Compromised 30,000 Developer Devices Through Fake Tech Interviews
Author: DigitalSpying Security Desk
Date: September 19, 2026
Category: Threat Intelligence / Advanced Persistent Threats (APT) / Software Supply Chain Security
Executive Summary
A joint international law enforcement and intelligence advisory—spearheaded by the Federal Bureau of Investigation (FBI), the Australian Cyber Security Centre (ACSC Advisory), and global cybersecurity partners—has sounded the alarm on an unprecedented espionage and digital theft operation operated by the Democratic People’s Republic of Korea (DPRK). Tracked under the moniker WaterPlum (and internationally identified as the operators behind the "Contagious Interview" campaign), this state-sponsored threat group successfully infected more than 30,000 developer and IT professional workstations across 100 countries between late 2025 and mid-2026.
As reported by BleepingComputer and The Record, WaterPlum systematically targets high-value personnel across software engineering, blockchain/Web3 development, cryptocurrency platforms, and defense contract industries. The threat actors approach targets on LinkedIn, X, Telegram, and Upwork masquerading as legitimate recruiters offering lucrative remote employment. Candidates are lured into executing trojanized technical assessments, cloneable GitHub repositories, or rogue video meeting software. Once executed, the multi-stage infection chain deploys custom cross-platform malware families—specifically BeaverTail and InvisibleFerret—to harvest browser passwords, Discord/Telegram session tokens, cryptocurrency wallet private keys, and enterprise cloud credentials, before establishing persistent backdoors within corporate development networks.
Deep-Dive Technical Analysis
1. The "Contagious Interview" Recruitment Lure
WaterPlum’s social engineering methodology relies on weaponizing the modern remote hiring and technical evaluation process:
* Persona Fabrication: Threat actors create polished professional profiles on LinkedIn and freelance portals, impersonating talent acquisition executives from prestigious tech unicorns, Web3 protocols, or venture capital firms.
* The Technical Challenge Vector: After brief conversational vetting, the recruiter directs the developer candidate to complete a technical coding test. This takes two common forms:
1. The Trojanized Git Repository: The victim is directed to a GitHub or GitLab repository hosting what appears to be a legitimate full-stack React/Node.js or Python application (e.g., an automated crypto trading bot or decentralized exchange interface).
2. The Fake Video Conferencing App: If the candidate requests an interview call, the attacker claims their corporate video system (disguised as Zoom, Webex, or Miro) requires installing a proprietary "secure meeting client" or web browser extension.
* Execution Trigger via Package Managers: When the developer clones the project and executes standard build commands (such as npm install, yarn, or pip install), hidden execution hooks trigger the payload silently.
+----------------------------------------------------------------------------------------------------+
| WATERPLUM INFECTION ARCHITECTURE |
|---|
[Target Developer / IT Contractor]
|
| 1. Approached via LinkedIn/Telegram with high-paying remote job opportunity
v
[Fake Technical Assessment / Coding Challenge]
|
| 2. Candidate clones Git repo and executes: "npm install" or runs fake meeting app
v
[Trojanized Package / npm preinstall Script]
|
| 3. Obfuscated JavaScript executes in Node.js runtime
v
[Stage 1 Payload: BeaverTail (JavaScript / Node.js Infostealer)]
|
+---> Extracts Chrome, Brave, Edge session cookies & saved logins
+---> Enumerates & loots browser wallet extensions (MetaMask, Phantom, Coinbase)
+---> Gathers local system info, network configuration, and IP address
|
| 4. Dispatches stolen credentials to C2 server via HTTPS POST
| 5. Downloads Stage 2 Payload in background
v
[Stage 2 Payload: InvisibleFerret (Python Backdoor / Reverse Shell)]
|
+---> Establishes persistent encrypted reverse shell to DPRK C2 infrastructure
+---> Deploys in-memory keylogger & clipboard monitor
+---> Scrapes local directories for sensitive assets (~/.ssh, ~/.aws, .env files)
+---> Establishes internal SOCKS5 proxy to tunnel into enterprise corporate network
2. Stage 1 Payload: BeaverTail Infostealer
Central to WaterPlum's initial compromise is BeaverTail (Malpedia BeaverTail), a lightweight, cross-platform JavaScript malware engineered to execute across Windows, macOS, and Linux:
* Obfuscation & Ingestion: BeaverTail is typically concealed inside benign-looking dependency files (e.g., setup.js or deeply nested inside node_modules). It relies on multiple layers of Base64 encoding, hex-encoded string arrays, and control-flow flattening.
* Targeted Wallet Exfiltration: BeaverTail explicitly hunts for extensions and local storage files corresponding to over 40 distinct cryptocurrency wallet extensions, including MetaMask, TronLink, Phantom, Exodus, Keplr, and Binance Wallet.
* Developer Asset Targeting: In addition to standard browser databases (Login Data, Cookies), BeaverTail hunts for developer-specific high-value assets:
* Local Git credentials (~/.git-credentials, ~/.gitconfig).
* SSH private keys (id_rsa, id_ed25519).
* Cloud configuration files (~/.aws/credentials, ~/.kube/config, ~/.azure/).
* Environment configuration files (.env) containing active database connection strings and Stripe/OpenAI API keys.
3. Stage 2 Payload: InvisibleFerret Persistent Backdoor
Once BeaverTail verifies that the compromised machine has internet connectivity and valuable assets, it drops InvisibleFerret (Malpedia InvisibleFerret), a modular Python-based backdoor:
* Persistence Mechanisms: InvisibleFerret installs itself into local user startup folders, schedules Cron jobs on macOS/Linux, or modifies Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run).
* AnyDesk & Remote Desktop Tooling: InvisibleFerret downloads and silently installs legitimate remote monitoring tools, such as headless instances of AnyDesk, configured with hardcoded authentication tokens, granting the operators direct interactive GUI access to the victim’s machine.
* Network Pivoting & SOCKS Tunneling: The malware includes a built-in reverse SOCKS proxy client. This capability transforms the developer's laptop into an internal jump host, enabling North Korean cyber operators to route attacks directly into the internal corporate VPN and enterprise intranet of the victim’s employer.
Geopolitical & Industry Impact
The revelation that WaterPlum compromised over 30,000 devices highlights the dual strategic objectives of North Korean state-sponsored cyber operations:
1. Financial Evasion & Sanctions Busting: Direct theft of digital assets from cryptocurrency projects and developer wallets provides immediate hard currency funding for DPRK weapons programs.
2. Software Supply Chain Infiltration: Compromising developer workstations is the modern equivalent of intercepting factory blueprints. By obtaining private source code repositories, commit signing keys, and CI/CD secrets, WaterPlum establishes the foundational access required to stage downstream supply-chain attacks against enterprise clients.
Recommendations & Mitigation Strategies
Organizations and developers must update their threat models to treat job recruitment and technical coding assessments as high-risk execution environments.
1. Developer Hygiene & Sandbox Isolation
* Never Run Untrusted Repositories on Bare Metal: All candidate coding assessments, open-source sample code, and third-party projects must be built and executed strictly inside isolated, disposable sandbox environments:
* Utilize ephemeral Docker containers, virtual machines, or cloud-hosted development platforms (GitHub Codespaces, Gitpod).
* Ensure local Docker engines do not mount the host home directory (~/.) into the container.
* Disable npm/yarn Lifecycle Scripts: When inspecting foreign repositories, execute dependency installations with scripts disabled:
npm install --ignore-scripts
yarn install --ignore-scripts
2. Enterprise Workforce Protections
* Corporate Laptop Segmentation: Strictly enforce policies forbidding the installation of personal communication tools (personal Telegram, Discord) or the pursuit of outside freelance contracts on corporate-managed laptops.
* Endpoint Detection & Response (EDR) Policy: Configure EDR solutions to monitor developer tools (VS Code, IntelliJ, Node.js) for unexpected child processes spawning shells (bash, sh, powershell) or attempting to read sensitive credential paths (~/.ssh, ~/.aws).
* Multi-Factor Authentication Hardening: Mandate hardware-bound FIDO2/WebAuthn security keys (e.g., YubiKeys) for all internal systems and cloud consoles, neutralizing the value of stolen session cookies and password hashes.