International Alert Issued Over North Korean ‘WaterPlum’ Malware Campaign Targeting Job Seekers

U.S. law‑enforcement agencies have joined forces with counterparts in Japan, Australia and Germany to warn of a new cyber‑espionage operation attributed to a North Korean hacking group, dubbed “WaterPlum.” The coordinated advisory says the campaign has infected thousands of devices in more than 100 nations, using deceptive recruitment fronts to pilfer cryptocurrency from individuals applying for jobs.

The joint statement from the Federal Bureau of Investigation, the Department of Defense, Japan’s National Police Agency and law‑enforcement bodies in Australia and Germany describes WaterPlum’s tactics as posing as artificial‑intelligence or blockchain service providers. Victims receive seemingly legitimate job‑application links that, once clicked, install malware capable of exfiltrating digital wallets and other sensitive data.

While the specific identity of the actors remains classified, analysts link the operation to known North Korean cyber units that have historically targeted financial assets to fund the regime’s activities. The use of “AI” and “blockchain” buzzwords reflects a broader trend in which threat actors exploit emerging technologies to lend credibility to phishing lures, a method that has proven effective against both tech‑savvy and non‑technical users.

Security researchers note that the malware deployed in the WaterPlum campaign appears to be modular, allowing it to adapt to different operating systems and to remain stealthy on compromised machines. Once installed, the code can monitor user activity, capture login credentials for cryptocurrency exchanges, and transmit wallet addresses back to command‑and‑control servers believed to be located in North Korea. The scale of the infection—spanning more than a hundred countries—suggests a coordinated rollout rather than isolated incidents.

Authorities urge job seekers to verify the authenticity of recruitment communications, especially those that request the download of software or the provision of wallet information. Recommended safeguards include using reputable job portals, avoiding unsolicited links, and employing up‑to‑date antivirus solutions. The advisory also calls on organizations to educate employees about the risks of socially engineered attacks that masquerade as legitimate employment opportunities.

The multinational warning underscores the growing convergence of cybercrime and state‑sponsored hacking, as financial gain increasingly fuels geopolitical objectives. As investigators continue to track WaterPlum’s infrastructure, they anticipate further guidance on mitigation steps and potential attribution updates. In the meantime, the coordinated effort aims to curb the spread of the malware and protect vulnerable users from losing cryptocurrency holdings to the North Korean actors behind the operation.