A North Korean hacking group used fake IT job offers to infect at least 30,000 computers and move about $10.7 million in cryptocurrency back to the regime.

The warning comes from a joint advisory by the FBI, Japanese police, Australian cyber officials and German intelligence dated September 18th.

The actor is called WaterPlum and is also known as Contagious Interview and Deceptive Development. It has been active worldwide since 2022.

From December of 2025 through July of 2026 the group hit machines in more than 100 countries, including the United States, Japan and Europe, and pulled funds or credentials from more than 7,000 crypto wallets.

It posts phony jobs on social media and recruiting sites, often posing as AI, crypto or NFT firms. Applicants are told to run coding tests or fix a fake video-call error. Those files load malware that watches the machine and steals passwords and wallet keys.

The group hides some of that activity on GitHub and Ethereum.

“The primary goal of the actor is to plunder cryptocurrencies and gain access to financial accounts. To achieve this, the actor uses a combination of manipulation (social engineering) and malicious software disguised as legitimate development tools.”

Investigators say WaterPlum and North Korea’s overseas IT workers likely sit under the 313 General Bureau of the Munitions Industry Department. Some of the same actors take remote jobs at foreign companies and send the pay home.