A North Korean cyber group known as WaterPlum infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026 to steal cryptocurrency and sensitive data. The hackers posed as recruiters for artificial intelligence, cryptocurrency and NFT firms to target software engineers and blockchain specialists through fake job offers, according to a joint advisory from the FBI and six other agencies. The campaign resulted in the theft of $10.71 million from more than 7,000 crypto wallets.

The group, also known as Contagious Interview, operates under the 313 General Bureau of the Munitions Industry Department subordinate to the Workers Party of Korea. Operators used AI face-swapping software during fake interviews to deceive victims before deploying malware via coding tests. The joint alert was issued by security agencies in Japan, the US, Australia and Germany to warn against ongoing efforts to infiltrate corporate networks and harvest professional credentials.