Four Countries Attribute “Contagious Interview” Fake-Job Malware Campaign to North Korea’s WaterPlum

A joint advisory from Japan, the U.S., Australia and Germany attributes the long-running "Contagious Interview" campaign to North Korean state‑sponsored group WaterPlum, reporting more than 30,000 infected machines and approximately ¥1.7 billion (~$10.7M) stolen in cryptocurrency. Operators posed as recruiters for AI, crypto and NFT roles to get candidates to run malicious code (often via npm packages on GitHub/Bitbucket), deploying multiple malware families (BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle) that harvest credentials, wallets, keystrokes, screenshots and more; the advisory includes mitigation guidance and flags compliance/sanctions risks for employers and contractors.