North Korea-linked cyber group WaterPlum, also known as Contagious Interview, stole at least $10.71 million by sending malware disguised as coding tests and technical-support files to software developers and IT professionals. A September 18 joint advisory from agencies in Japan, the United States, Australia and Germany said the campaign infected more than 30,000 devices in over 100 countries and compromised funds or credentials from more than 7,000 cryptocurrency wallets between December 2025 and July 2026. Authorities assessed that WaterPlum operates under General Bureau 313 of the Munitions Industry Department under the Central Committee of the Workers' Party of Korea. The operation impersonated employers and recruiters in the AI, cryptocurrency and NFT sectors, deploying malware including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and the Node.js-based StoatWaffle. Japanese authorities also dismantled the first laptop farm confirmed in Japan, where domestic collaborators enabled overseas North Korean IT workers to remotely operate Japan-based computers. The advisory urged affected victims to move assets to a new wallet created on a separate device, store its seed phrase offline and factory-reset the infected device.