FBI warns North Korean group infected at least 30,000 PCs

A joint advisory dated September 18 warns that the North Korean hacking group WaterPlum used fake IT job offers to infect at least 30,000 computers and move about $10.7 million in cryptocurrency back to the regime. The advisory was issued by the FBI, Japanese police, Australian cyber officials and German intelligence. WaterPlum is also known as Contagious Interview and Deceptive Development, and has operated worldwide since 2022. From December 2025 through July 2026, the group targeted machines in more than 100 countries, including the United States, Japan and Europe. It took funds or credentials from more than 7,000 crypto wallets. The group posts fake jobs on social media and recruiting websites while posing as AI, crypto or NFT companies. Applicants are asked to run coding tests or fix a fake video call error, and the files used for those tasks load malware that monitors computers and steals passwords and wallet keys. The group also hides some of its activity on GitHub and Ethereum. The advisory says its primary goals are to steal cryptocurrency and gain access to financial accounts through social engineering and malicious software disguised as legitimate development tools. Investigators say WaterPlum and North Korea's overseas IT workers likely operate under the 313 General Bureau of the Munitions Industry Department. Some of the same actors take remote jobs at foreign companies and send their pay home. The advisory says the operation poses a short-term threat to people and companies in Germany and other European Union states. The FBI is still pursuing U.S. helpers who operate laptop farms and bank accounts for those workers.