A cyber group known as WaterPlum compromised the networks of software developers by posing as recruiters for artificial intelligence and cryptocurrency firms. A joint security alert from the FBI and agencies in Japan, Australia, and Germany revealed the group infected more than 30,000 computers in 100 countries between December 2025 and July 2026. These hackers stole a total of 1.7 billion yen, or $10.7 million, from over 7,000 cryptocurrency wallets targeting professionals in Europe, the US, and Japan.

Hackers employed AI face-swapping software during fake technical interviews before disabling cameras and citing network issues to mask their identities. WaterPlum operates under the 313 General Bureau of the Munitions Industry Department of the Workers Party of Korea. The investigation into the fake job phishing and malware attacks led to the seizure and dismantling of Japan's first "laptop farm" associated with the campaign.