https://www.ic3.gov/CSA/2026/260918.pdf
WaterPlum campaign tied to 30,000 infections across 100+ countries A joint advisory from US, Japanese, Australian, and German authorities says North Korean group WaterPlum compromised at least 30,000 devices between Dec. 2025 and Jul. 2026, hit more than 7,000 crypto wallets, and moved $10.7 million to the DPRK. The activity is linked to the “Contagious Interview” scheme using #fake recruiting, coding tests, malicious npm packages