WaterPlum Infects 30,000 Devices, Drains 7,000 Crypto Wallets via Fake Recruiter Malware

The campaign contacts engineers, designers and blockchain specialists on LinkedIn, freelance sites and social platforms, directing them to download interview files that deploy infostealers and remote access tools. Japanese police recovered the same malware families previously linked to $12 million in losses in April incidents also aimed at developers. Once installed, operators maintain persistence on personal machines in anticipation of victims securing employment at target firms, enabling lateral movement into corporate networks.

Procurement records and IP overlap data show the same infrastructure supports both device infections and the parallel IT-worker placement scheme. Japanese authorities dismantled a domestic laptop farm where North Korean actors used AI face-swapping and text-to-speech tools to impersonate local applicants; several hundred million yen had already been routed abroad. The General Bureau of the Munitions Industry coordinates these operations, treating stolen identities and wallet access as interchangeable revenue streams.

Independent technical indicators—shared C2 domains, consistent malware compilation timestamps and credential-harvesting patterns—align across the FBI, Japan’s National Police Agency and German and Australian partners, yet public attribution still rests on agency statements rather than released packet captures or full malware samples. This gap leaves open the possibility that additional actors reuse the same tooling.

Expect continued targeting of remote crypto and AI roles through Q4 2026, with operators shifting to new malware variants once existing ones are burned by public advisories.