A joint multinational cybersecurity advisory from the FBI, Japan’s NPA, Germany’s BfV/BND, and Australia’s ACSC revealed that North Korean state-sponsored actor WaterPlum—operating under the Munitions Industry Department’s 313th General Bureau—compromised over 30,000 developer workstations worldwide. Operating the “Contagious Interview” campaign, operatives pose as recruiters on freelance and developer platforms, directing software engineers to clone and execute malicious code repositories under the guise of technical hiring assessments. Poisoned npm dependencies and weaponized VS Code workspace tasks trigger lifecycle hooks during initialization, downloading BeaverTail, an in-memory JavaScript infostealer that extracts browser credentials, crypto wallet files, and SSH keys before staging InvisibleFerret, a modular Python backdoor with keylogging and reverse shell capabilities.

Telemetry indicates the campaign breached systems across more than 100 countries between December 2025 and July 2026, siphoning credentials from over 7,000 cryptocurrency wallets and transferring $10.7 million (1.7 billion JPY) to DPRK state-controlled accounts. The operators combined AI-generated face-swapping in fake video calls with secondary multi-platform payloads, including StoatWaffle and OtterCandy, to establish persistent footholds across macOS, Linux, and Windows development machines.

Why it matters:

• Developer trust exploitation bypasses network perimeters: Weaponizing legitimate package lifecycle hooks and IDE project files allows adversaries to achieve arbitrary execution directly inside trusted developer endpoints, extracting high-value source code, cloud credentials, and private keys while bypassing traditional boundary defenses.
• Strict sandbox isolation for untrusted code: Engineering organizations must mandate containerized, disposable sandbox environments for assessing external codebases, enforce strict package manager script blocking (npm install --ignore-scripts), and isolate developer identity tokens from local execution runtimes.