cyber.hendryadrian.com
Security News · therecord.media

WaterPlum Campaign Infected 30,000 Devices and Stole $10.5 Million, Advisory Says

· Original article ↗

Summary

A law-enforcement advisory says WaterPlum actors posing as AI and blockchain recruiters infected at least 30,000 devices in 100 countries and stole funds or credentials from about 7,000 cryptocurrency wallets.

Key points

  • The advisory says the campaign infected at least 30,000 devices across 100 countries between December 2025 and July 2026.
  • WaterPlum actors allegedly stole more than $10.5 million and targeted about 7,000 cryptocurrency wallets.
  • Job seekers were approached through social media, gig-work sites, and freelance portals, then directed to download files during interviews.
  • Japanese police found BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware on victim devices.
  • Actors used infostealers and remote-management tools to steal wallet credentials and maintain access to victims’ devices.
  • Authorities linked the campaign to North Korean IT-worker schemes and said actors used the same IP addresses when accessing laptop farms or applying for jobs.

Article Details

Event Type
Law enforcement advisory on the WaterPlum cyber campaign targeting job seekers with malware disguised as AI and blockchain recruitment files.
Impact
The campaign reportedly infected at least 30,000 devices across 100 countries between December 2025 and July 2026 and stole funds or credentials from about 7,000 cryptocurrency wallets. More than $10.5 million was reported stolen. Malware also enabled credential theft and continued access to victims’ devices, potentially facilitating access to employers’ systems.

Threat Actors

Contagious InterviewGroup of cyber actors allegedly responsible for the campaign targeting job applicants and stealing cryptocurrency.

Malware

BeaverTailThe operation overlapped with North Korean IT worker schemes and used malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal cryptocurrency wallet credentials and maintain access.InvisibleFerretThe operation overlapped with North Korean IT worker schemes and used malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal cryptocurrency wallet credentials and maintain access.OtterCandyThe operation overlapped with North Korean IT worker schemes and used malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal cryptocurrency wallet credentials and maintain access.OtterCookieThe operation overlapped with North Korean IT worker schemes and used malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal cryptocurrency wallet credentials and maintain access.StoatWaffleThe operation overlapped with North Korean IT worker schemes and used malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal cryptocurrency wallet credentials and maintain access.

Countries

Australiaand Defense Department partnered with Japan’s National Police Agency and law enforcement agencies in Australia and Germany on a new advisory about “WaterPlum” — a group of cyber actors allegedly stealingGermanyDepartment partnered with Japan’s National Police Agency and law enforcement agencies in Australia and Germany on a new advisory about “WaterPlum” — a group of cyber actors allegedly stealing cryptocurrency from jobJapanThe FBI and Defense Department partnered with Japan’s National Police Agency and law enforcement agencies in Australia and Germany on a new advisory about “WaterPlum” — a group of cyber actors allegedly stealingNorth KoreaThe report said the WaterPlum campaign and several IT worker schemes are run through North Korea’s General Bureau of the Munitions Industry Department — which is within the Central Committee of the Workers Party of

Industries

CryptocurrencyThe operation overlapped with North Korean IT worker schemes and used malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal cryptocurrency wallet credentials and maintain access.DefenseThe FBI and Defense Department partnered with Japan’s National Police Agency and law enforcement agencies in Australia and Germany on a new advisory about “WaterPlum” — a group of cyber actors allegedly stealingNews mediajob seekers in the defense industry, and Google warned in 2022 that 250 people working for 10 different news media, domain registrars, web hosting providers and software vendors were targeted with malicious emails fromSoftware2022 that 250 people working for 10 different news media, domain registrars, web hosting providers and software vendors were targeted with malicious emails from fake recruiters claiming to be from Disney, Google andTechnologyAccording to the report, the WaterPlum campaign is deeply intertwined with the IT worker scheme — where North Koreans steal or purchase identities to get hired in lucrative roles at technology firms in the U.S.Web hostingand Google warned in 2022 that 250 people working for 10 different news media, domain registrars, web hosting providers and software vendors were targeted with malicious emails from fake recruiters claiming to be

Related Articles