North Korean hackers compromise 30,000 computers via fake job interviews

A joint advisory from seven agencies across Japan, the U.S., Australia, and Germany revealed that the North Korean hacker group WaterPlum has been targeting software engineers through fake job interviews. Posing as recruiters for AI, crypto, and NFT firms, the group tricked victims into executing malicious code disguised as technical assignments. Between December 2025 and July 2026, the campaign compromised at least 30,000 computers across 100 countries, resulting in the theft of $10.71 million in crypto assets from over 7,000 wallets. The hackers utilized remote access trojans and info-stealers to harvest credentials, private keys, and personal identification documents. Japanese authorities also reported the first domestic dismantling of a 'laptop farm' used by North Korean IT workers to facilitate remote operations and money laundering.