North Korean hacker group WaterPlum drains 7,000 crypto wallets

A joint alert from seven international law enforcement and cybersecurity agencies warns of the North Korean hacker group WaterPlum, also known as Contagious Interview. The group has compromised 30,000 devices and drained over 7,000 crypto wallets, stealing $10.71 million between December 2025 and July 2026. The hackers pose as recruiters for AI, crypto, or NFT firms, tricking developers into downloading malicious NPM packages containing malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle to steal private keys and wallet credentials.