A North Korea-linked cyber campaign known as WaterPlum, also tracked as Contagious Interview, compromised at least 30,000 devices in more than 100 countries and drained at least ¥1.7 billion ($10.71 million) from more than 7,000 cryptocurrency wallets between late 2025 and July 2026. A joint advisory involving Japan's National Police Agency, the FBI and agencies from Australia and Germany said the group posed as recruiters from artificial-intelligence, blockchain and technology companies, using fake interviews and coding assessments to deliver malware. Authorities assessed that Waterplum and associated North Korean IT workers operate under Bureau 313 of the Workers' Party of Korea's Munitions Industry Department. Japanese police also dismantled a domestic laptop farm that enabled remote North Korean workers to appear locally based while seeking outsourced jobs. Agencies urged companies and freelance workers to run untrusted code in isolated sandbox environments and apply workspace controls to limit software exploits.