North Korea-backed hackers infect 30,000 devices, drain $11 million

A North Korea-backed hacking group infected more than 30,000 computers in over 100 countries. Japan's National Police Agency and the FBI said the group stole data from more than 7,000 crypto wallets. Wallets controlled by the group received at least $10.71 million in digital assets between December 2025 and July 2026. The agencies call the group WaterPlum, also tracked as Contagious Interview. WaterPlum posed as a recruiter for artificial intelligence, cryptocurrency and non-fungible token firms. The group targeted developers through social media, job boards and freelance marketplaces. It directed applicants to download files for technical interviews or coding tests. The files contained malware that searched for browser passwords, screenshots, keystrokes and crypto wallet keys. Japanese police shut down the country's first known laptop farm. Local helpers kept computers in their homes while North Korean workers abroad controlled them remotely and posed as Japanese residents to win freelance contracts. Investigators said those workers sent several hundred million yen worth of crypto overseas. Investigators linked the farm to the hackers through the same internet addresses. One suspected North Korean used a stolen resume to apply for an engineering role at Japanese exchange bitFlyer in May 2025. The applicant was not hired after interviewers noticed that he refused to relocate and demanded payment in crypto.