#WaterPlum (aka Contagious Interview) Attack Incident
Overview
The U.S. FBI and Japan’s National Police Agency jointly issued an early warning: the North Korea-linked hacking group WaterPlum operated during the period 2025-12 to 2026-07. It targeted 100+ countries worldwide, infected 30,000+ devices, compromised 7,000+ encrypted wallets, and the total stolen assets amounted to USD 10.71 million.
Attack Methods (Fake Hiring Trap)
1. Posing as HR from Web3, AI, or NFT companies on social platforms and recruitment channels, targeting developer job seekers and sending interview invitations.
2. Sending malicious GitHub repositories or compressed archive projects under the guise of programming tests and technical assessments.
3. Exploiting a vulnerability in VS Code’s tasks.json with runOn:folderOpen: when victims open the project folder, the malicious Node.js program StoatWaffle is executed automatically without the need for any manual clicking. It works across Windows/macOS/Linux platforms.
4. The trojan steals browser data and wallet plugin private keys (such as MetaMask) and automatically transfers assets to the hackers’ wallets.
Key Features
- Malicious Payload StoatWaffle: It automatically installs a Node.js runtime environment, downloads subsequent data-stealing and remote-control modules, has high stealth, and is difficult for conventional antivirus tools to detect and remove.
- Primary Attack Targets: Web3 developers and freelance programmers, not ordinary retail users.
- The organization has links to personnel of North Korea’s Unit 313 IT division. This is a social-engineering + supply-chain style attack—not an exchange hack that led to stolen funds; instead, coins are stolen when end-user devices get compromised.
User Protection Tips
1. Do not directly open code repositories or compressed archives sent by unknown interviewers in VS Code; first perform sandbox isolation and inspection.
2. Be cautious of strangers’ tasks.json configurations in VS Code; do not casually trust external workspaces.
3. Hardware wallets can greatly reduce the risk of this kind of endpoint credential/theft attack; do not store large amounts of assets in hot wallets on daily development machines.
4. Be highly alert to overseas roles encountered in which compensation is unusually generous, and only online tests are offered without any video-based in-person interview.
After encrypted assets are stolen, tracing them on-chain is difficult. With this kind of social-engineering trojan attack, once a private key is exposed, the funds are basically very hard to recover.
Overview
The U.S. FBI and Japan’s National Police Agency jointly issued an early warning: the North Korea-linked hacking group WaterPlum operated during the period 2025-12 to 2026-07. It targeted 100+ countries worldwide, infected 30,000+ devices, compromised 7,000+ encrypted wallets, and the total stolen assets amounted to USD 10.71 million.
Attack Methods (Fake Hiring Trap)
1. Posing as HR from Web3, AI, or NFT companies on social platforms and recruitment channels, targeting developer job seekers and sending interview invitations.
2. Sending malicious GitHub repositories or compressed archive projects under the guise of programming tests and technical assessments.
3. Exploiting a vulnerability in VS Code’s tasks.json with runOn:folderOpen: when victims open the project folder, the malicious Node.js program StoatWaffle is executed automatically without the need for any manual clicking. It works across Windows/macOS/Linux platforms.
4. The trojan steals browser data and wallet plugin private keys (such as MetaMask) and automatically transfers assets to the hackers’ wallets.
Key Features
- Malicious Payload StoatWaffle: It automatically installs a Node.js runtime environment, downloads subsequent data-stealing and remote-control modules, has high stealth, and is difficult for conventional antivirus tools to detect and remove.
- Primary Attack Targets: Web3 developers and freelance programmers, not ordinary retail users.
- The organization has links to personnel of North Korea’s Unit 313 IT division. This is a social-engineering + supply-chain style attack—not an exchange hack that led to stolen funds; instead, coins are stolen when end-user devices get compromised.
User Protection Tips
1. Do not directly open code repositories or compressed archives sent by unknown interviewers in VS Code; first perform sandbox isolation and inspection.
2. Be cautious of strangers’ tasks.json configurations in VS Code; do not casually trust external workspaces.
3. Hardware wallets can greatly reduce the risk of this kind of endpoint credential/theft attack; do not store large amounts of assets in hot wallets on daily development machines.
4. Be highly alert to overseas roles encountered in which compensation is unusually generous, and only online tests are offered without any video-based in-person interview.
After encrypted assets are stolen, tracing them on-chain is difficult. With this kind of social-engineering trojan attack, once a private key is exposed, the funds are basically very hard to recover.