On September 18, the Japanese National Police Agency, together with the National Cyber Bureau, as well as the U.S. FBI, the U.S. Department of Defense Cyber Crime Center, the Australian Signals Directorate / Cyber Security Centre, Germany’s Federal Intelligence Service and the Federal Office for the Protection of the Constitution, issued a joint report in a six-party effort. The protagonists are a hacker group with a North Korean background—WaterPlum (also known as "Contagious Interview," literally "Disguised Interview").

This Contagious Interview attack activity has been tracked for years by multiple international security vendors, and it is often believed to be associated with North Korea’s Lazarus Group. This time, for the first time, Japanese police disclosed specific domestic cases and seized evidence under an official name, in cooperation with agencies from multiple countries.

Report link: https://www.npa.go.jp/bureau/cyber/pdf/20260918_j.pdf

Core data

How the attack happens

The core of WaterPlum’s scheme isn’t complicated: it impersonates the hiring party.

Step 1: Lure deployment

After targeting someone, the scheme generally goes like this: they invite you to a “technical interview” or give you a programming test question. During the test, they will ask you to download a “project file” from a code repository such as GitHub. The reason is usually something like “help fix a bug in this video conferencing tool,” or “finish the test using this template.”

Step 2: Technical interview traps

After contacting the target, the routine is usually as follows: they offer you a “technical interview” or a programming test. During the test, they ask you to download a “project file” from a code repository like GitHub. The reasons are typically “help fix a bug in this video conferencing tool” or “complete the test using this template.”

In many cases, this file is the malicious program.

Step 3: Malware deployment

The police specifically named several related malware families in the report: BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle.

Worth mentioning is that a piece of malware called StoatWaffle disguises itself as a blockchain-related project repository and automatically executes code through a VS Code configuration file called .vscode/tasks.json. In other words, once you open that project folder and select “Trust,” the code may already be running in the background—you don’t even need to click Run manually.

The police also specifically remind: if you receive an unfamiliar VS Code project, be sure to open it in “restricted mode.” When you see the prompt “Do you want to trust the author of this folder?”, selecting “No” helps you avoid this trap. Also, don’t put an unknown project into a folder you previously set to “Trust,” and don’t disable the workspace trust security setting just for convenience.

Step 4: Data theft and lateral movement

These malware are hidden inside NPM packages disguised as normal code libraries. Once executed, they install backdoors on the computer, connect to remote servers, and then start scraping various sensitive information: account credentials stored in browsers, clipboard contents, keylogging, screenshots, the private keys and seed phrases of encrypted wallets, and photos of identification documents (such as driver’s licenses and passports).

The stolen account credentials are not just used for selling money. The police pointed out that attackers use these stolen credentials to break into the victim company’s internal network, enabling deeper infiltration—for example, stealing intellectual property and moving laterally further within the corporate environment. And the stolen photos of identification documents (e.g., driver’s licenses, passports) could also be used by North Korean IT laborers to impersonate identities and make extra money in the overseas job market.

Between December 2025 and July 2026, the police had gathered data showing that in over 100 countries and regions worldwide, at least 30,000 computers were compromised, more than 7,000 encrypted wallet information records were stolen, and assets flowing into wallets controlled by WaterPlum were at least about 1.7 billion yen (roughly 10.71 million USD).

“Notebook farm” that Japan took down for the first time

The most值得关注 part of this report isn’t actually the malware itself, but the fact that for the first time in Japan, the police seized and dismantled a “laptop farm” (Laptop Farm).

Simply put: North Korean IT laborers aren’t in Japan, but they persuade (or bribe) someone living in Japan to put a computer in that person’s home, and then remotely control that computer to do the work. From the outside, it looks like “a local in Japan” is handling the job, but the actual operator may be far away in North Korea, China, or Russia.

What this in-Japan helper (called a “supporter” in the report) did included: providing accommodation to place the computer, providing network access, and even giving their own identification documents to the North Korean workers to let them impersonate and take contracts. In some cases, the contracts taken by the supporter were completed through a “shell company” arrangement by the North Korean workers. In other cases, the supporter’s own bank account was designated as the receiving account—the money would be transferred in, and then they would find a way to move it out. In addition, they also used VPS servers rented on behalf of the supporter to further obscure the true location of the work.

The police determined that using this method, North Korean IT laborers had transferred encrypted assets worth hundreds of millions of yen overseas. The report also explicitly states the destination of the money: it was used for purposes such as weapon development. At the same time, the report clearly warns that outsourcing work to North Korean IT laborers and paying them remuneration may violate domestic laws and sanctions against North Korea.

bitFlyer incident: North Korean IT laborers infiltrate a Japanese cryptocurrency exchange

In May 2025, the Japanese cryptocurrency exchange bitFlyer received a job application for an engineer position. Later, it was confirmed that the application most likely came from North Korean IT laborers, and the entire process was documented in this report—making it a vivid case study.

This applicant went through no intermediaries at all and submitted the résumé directly through the company’s official website. The contact email used was Gmail. When logging into the job-application system, they had VPN enabled (NETNUT Proxy, Astrill VPN, and High Speed Rabbit Proxy were all specifically mentioned). The skills listed on the résumé were quite “comprehensive”: they claimed to know more than a dozen programming languages, were skilled in blockchain and cloud services, stated their education was from a university in Europe, and then worked across multiple countries.

bitFlyer was on guard and arranged a video interview. A series of details that look quite typical in hindsight appeared during the interview: the applicant’s appearance looked Asian, but they claimed to be of Malaysian descent, had been living in Finland for years. Their native languages were said to be Malay and Chinese. The whole interview was conducted in English, but their English clearly couldn’t support the education and experience listed on the résumé. When asked about specific skills mentioned on the résumé, they could answer basic questions, but once things went slightly deeper, they started to dodge and the answers became empty.

In addition, there were other suspicious details: whenever they mentioned moving to Japan to work, they kept making excuses or refusing, saying things like “let’s see after six months.” They insisted on getting paid in cryptocurrency and refused to come on-site. During the interview, they kept looking to another screen off to the side as if reading answers. In the background, you could sometimes hear other people talking. And the video feed frequently froze and skipped frames.

bitFlyer ultimately identified the problem and did not hire the person. bitFlyer is also listed in the acknowledgements section of this report.

In the report, Japan’s National Police Agency and the FBI gave a clear judgment: the cyberattack activities of WaterPlum and the currency-earning activities of some North Korean IT laborers were both directed by the Office of the Defense Industry Bureau (General Department No. 313) of the Workers’ Party of Korea’s Central Committee.

A key piece of evidence supporting this judgment was IP address overlap: IPs used by WaterPlum attackers, IPs used by North Korean IT laborers to connect the laptop farm and the crowdsourcing platforms, and the IP used by the North Korean laborer who applied to bitFlyer when logging into the job-application system—all matched up.

The bulletin also disclosed some day-to-day work details of WaterPlum members. For example: they used an AI face-swapping app called “Magicam” to handle video interviews, but generally only dared to use it for a few minutes and then turned off the camera on the excuse that the “network is bad.” When it came to a certain North Korean anniversary, the higher-ups granted special approval for playing games for a period of time (mainly simulation/management titles), and some people were also photographed watching football match videos. In daily life, they used voice-reading software like “NaturalReader” to practice Japanese pronunciation, and most translation and AI tools were the free versions.

What can be done

For ordinary IT professionals, especially freelancers, these are the most practical suggestions:

  • Don’t just run code from strangers on computers handling work or encrypted assets. If you really need to test it, run it in a virtual machine;

  • If you encounter commands like curl, base64, mshta, or Invoke-WebRequest in a script, don’t rush to execute it—figure out what it’s actually doing first;

  • Once an antivirus alerts, the first reaction should be to disconnect from the network, not just delete the virus and pretend nothing happened—because the information may have already been stolen before you’re discovered;

  • For wallet-related assets, move them to a new wallet as soon as possible, save the recovery seed phrase by handwriting it, and don’t keep it in your computer anymore;

  • If conditions allow, reinstalling the system directly is safer.

For companies hiring and outsourcing teams:

  • In a short time, a niche position suddenly receives a pile of résumés—keep an eye out;

  • For candidates whose résumés list unusually comprehensive skills, during the interview feel free to ask a few more specific questions to see whether they truly know it or have simply memorized it;

  • Insisting on being paid with cryptocurrency, refusing to come in person, and requiring the money to be transferred to someone else’s account are all signals worth asking about;

  • Chatting a bit about the candidate’s local weather or lifestyle habits can sometimes reveal them more easily than technical questions.

Summary

In short, this report isn’t just another disclosure of a malicious organization with a North Korean background—it demonstrates an increasingly complex attack pattern: attackers can enter a person’s endpoint from job postings, then move into the company network from that endpoint, and ultimately cash out directly by stealing credentials and encrypted-asset wallet information. Meanwhile, another identity-masquerading layer and the Laptop Farm infrastructure can also help the relevant people break into overseas IT labor markets. One line relies on phishing to steal encrypted assets, and the other line relies on masquerading identities to slip into overseas labor markets—these two tracks intertwine and cover each other.

For individuals and companies, your vigilance shouldn’t be limited to “antivirus.” Security considerations should also be included in hiring, outsourcing, and identity verification. The report concludes by emphasizing that future attack methods will continue to evolve and become more complex. Companies and individuals should keep monitoring early warnings from domestic and overseas security agencies and reports released by security vendors.