Japan’s National Police Agency and the FBI identified a campaign by North Korea-linked WaterPlum that targeted job seekers across 100 countries from December 2025 to July 2026. The group infected more than 30,000 devices by impersonating recruiters from AI, NFT, and cryptocurrency firms to trick candidates into installing malware.

The operation stole data from over 7,000 crypto wallets, with $10.71 million moved to assets controlled by the hackers. Japanese police also dismantled the first domestic laptop farm found supporting North Korean IT workers, including one who attempted to gain employment at crypto exchange bitFlyer in May 2025.