North Korea's Contagious Interview campaign turns job tests into malware delivery

North Korea's Contagious Interview campaign turns job tests into malware delivery

Executive Summary

A new joint advisory from Japan, the United States, Australia, and Germany puts hard numbers behind a threat that many developer and hiring teams have been feeling for years: North Korea-linked WaterPlum, commonly known as Contagious Interview, has infected at least 30,000 devices in more than 100 countries and extracted funds or account credentials from more than 7,000 cryptocurrency wallets.

The campaign does not begin with a noisy exploit against an exposed server. It begins with trust. Threat actors pose as recruiters or prospective employers, send software developers and IT professionals to realistic coding assessments, and hide malware inside repositories, npm packages, Visual Studio Code project files, and troubleshooting steps. Once the victim runs the code, the operators use loaders, stealers, and remote access tooling to harvest credentials, cryptocurrency wallets, identity documents, browser data, SSH material, and corporate access.

For defenders, this is a threat intelligence story as much as a malware story. The strongest response is not only to warn job seekers. Organizations need hiring, engineering, endpoint, identity, and SOC teams to treat untrusted technical assessments as a real intrusion path into future employers, clients, repositories, cloud tenants, and production systems.

What happened?

On September 18, 2026, the National Police Agency of Japan, Japan's National Cybersecurity Office, the FBI, the U.S. Department of Defense Cyber Crime Center, ASD's Australian Cyber Security Centre, Germany's BND, and Germany's BfV published a joint advisory on North Korean WaterPlum activity and North Korean IT worker schemes.

The agencies assess that WaterPlum actors pose as prospective employers and recruiters to target software developers, web freelancers, cryptocurrency specialists, blockchain engineers, and Web3 professionals. Victims are approached through social media, job platforms, gig work marketplaces, freelance sites, chat platforms, and recruiting services. The lure is usually a promising job opportunity or technical interview.

The infection path is familiar but effective:

• a recruiter persona establishes credibility;
• the target is asked to complete a coding assignment or troubleshoot a video interview issue;
• the project is hosted on a normal developer platform such as GitHub, Bitbucket, GitLab, or another collaboration service;
• malicious code is hidden in what looks like an ordinary project dependency, npm package, VS Code configuration, or helper script;
• execution launches malware families and variants such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, RATatouille, StoatWaffle, FlexibleFerret, GolangGhost, and PylangGhost;
• operators preserve access, steal credentials, exfiltrate data, and use command-and-control infrastructure to manage infected devices.

The advisory says WaterPlum infected at least 30,000 PCs between roughly December 2025 and July 2026. The group reportedly extracted cryptocurrency funds or wallet credentials from more than 7,000 wallets and transferred about 1.7 billion JPY, equivalent to $10.71 million, to the DPRK.

Why this matters for defenders

1. The target is the developer, but the blast radius is the business

The campaign often starts on a personal or candidate-owned machine, which can make it seem outside the enterprise boundary. That is a mistake. Developers and IT professionals routinely hold access to source repositories, package registries, cloud consoles, customer environments, test credentials, SSH keys, API tokens, browser sessions, password managers, and internal collaboration platforms.

If a victim later joins a legitimate employer or already works with clients, the infected device or stolen identity material can become a route into those environments. The advisory explicitly warns that successful infections can enable espionage, intellectual property theft, downstream lateral movement, and extortion.

2. Coding assessments have become a social engineering attack surface

Technical hiring workflows are built around trust signals: realistic projects, public repositories, modern framework stacks, plausible recruiter profiles, and pressure to perform quickly. WaterPlum abuses all of those signals. Atlassian's parallel research on Contagious Interview found repeated repository themes, convincing front companies, recruiter personas, and a pattern where victims were sometimes asked to record walkthroughs and upload their own copies of malicious repositories, unintentionally becoming distributors.

That makes this a mature social engineering campaign with a developer tooling wrapper. The attacker does not need to defeat a perimeter firewall when the victim voluntarily clones, trusts, and runs the project.

3. VS Code trust decisions matter

The advisory calls out malicious Visual Studio Code projects, including .vscode/tasks.json execution paths. If a candidate opens an unknown folder and marks it as trusted, project tasks can run automatically or create a smoother path to payload execution. This is not theoretical hygiene advice. The threat actors are specifically using developer workflow features to blur the line between "assessment setup" and code execution.

Teams should treat untrusted coding tests like untrusted binaries. Run them in an isolated virtual machine or disposable environment, not on a workstation that can reach production, customer repositories, wallet material, corporate SSO sessions, or privileged cloud accounts.

What defenders should do now

For engineering and hiring teams

Require dedicated, isolated environments for any third-party coding assessment. Candidates and employees should not run unknown repositories on machines that contain company credentials, browser sessions, password vaults, SSH keys, crypto wallets, cloud configuration files, or source-code access.

Recruiting and engineering managers should also update interview guidance. Legitimate interviewers should not ask candidates to run opaque scripts, disable security controls, paste shell commands they do not understand, install suspicious dependencies, or troubleshoot interview tooling by executing code from a random repository.

For SOC and endpoint teams

Tune endpoint detection and response coverage around developer tools. Focus on IDEs, terminals, package managers, and scripting runtimes launching suspicious child processes, especially when activity originates from newly cloned interview repositories or temporary project directories.

Useful behavioral signals include:

• code, node, npm, python, bash, zsh, powershell, or cmd spawning unexpected network tools;
• .vscode/tasks.json launching scripts from untrusted folders;
• package install steps that download remote scripts with curl, wget, Invoke-WebRequest, or encoded PowerShell;
• scripting runtimes accessing browser profiles, password stores, keychains, .ssh, cloud config folders, .env files, shell history, or cryptocurrency wallet directories;
• sudden outbound traffic to unknown IPs or domains immediately after a coding assessment is opened;
• archive creation or HTTP uploads involving credential paths, browser databases, screenshots, keylogs, or identity documents.

For identity and cloud teams

Assume credential theft can outlive the malware event. If a developer or contractor may have run a malicious assessment, rotate source-control tokens, SSH keys, API keys, cloud credentials, OAuth grants, and active SSO sessions from a known-clean device. Check whether the affected identity had access to package registries, CI/CD secrets, production logs, customer data, deployment keys, or shared password vaults.

Where possible, enforce hardware-backed MFA, short-lived cloud credentials, conditional access, least-privilege roles, and device posture checks for developer access. WaterPlum's value chain depends on turning endpoint compromise into reusable access.

For incident responders

Do not stop at deleting the repository. The advisory warns that RATs and follow-on malware may preserve persistence even after the obvious files are removed. Affected endpoints should be isolated, investigated, and reimaged when compromise is likely. Recovery should include credential rotation, wallet migration from a clean device, session revocation, and an incident response review of downstream systems the victim could access.

Preserve the repository URL, recruiter messages, commands executed, package names, process trees, network destinations, and timestamps. These artifacts are critical for scoping whether the incident was limited to one workstation or reached corporate systems.

Example hunt ideas

The exact telemetry will vary by stack, but these patterns give defenders a starting point.

Suspicious IDE-to-shell execution

index=edr
(process_name IN ("code.exe","Code Helper","node","npm","python","powershell.exe","cmd.exe","bash","zsh"))
(".vscode" OR "tasks.json" OR "coding" OR "assessment" OR "interview" OR "test")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(command_line) as commands by host, user, parent_process_name, process_name

Developer tools touching sensitive stores

index=edr
(process_name IN ("node","npm","python","powershell.exe","bash","zsh","code.exe"))
(".ssh" OR "id_rsa" OR "known_hosts" OR ".aws" OR ".azure" OR ".gcp" OR ".env" OR "Login Data" OR "Cookies" OR "keychain" OR "wallet")
| stats count values(file_path) as files values(command_line) as commands by host, user, process_name

Network activity after package install or project launch

index=proxy OR index=edr_network
(process_name IN ("node","npm","python","powershell.exe","bash","zsh","curl","wget"))
(url="*github*" OR url="*bitbucket*" OR url="*gitlab*" OR url="*npm*" OR dest_port IN (80,443,8080,8443))
| stats count min(_time) as firstSeen max(_time) as lastSeen values(url) as urls by host, user, process_name, dest_ip, dest_port

These are intentionally broad. Mature teams should enrich them with newly published indicators, repository names, domains, IPs, recruiter aliases, and known malware family telemetry from the advisory and related reports.

Strategic takeaway

Contagious Interview shows how modern intrusion chains are moving closer to the human workflows that security teams often treat as peripheral. The attacker does not need a zero-day when a credible recruiter can persuade a developer to run a polished project on a machine full of valuable secrets.

The practical defense is cultural and technical at the same time: normalize isolated interview environments, make suspicious recruiter behavior reportable, monitor developer tooling like a real attack surface, and rotate credentials aggressively when a coding assessment crosses the line from awkward to unsafe.

WaterPlum is not only stealing cryptocurrency. It is exploiting the trust model of remote work, freelance hiring, and software development. Defenders who understand that model will see the intrusion earlier.

References

1. North Korean WaterPlum, commonly referred to as Contagious Interview, Cyber Actor Group Targeting IT Professionals
2. From fake interviews to malicious repositories: Disrupting Contagious Interview
3. Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
4. Contagious Interview