On September 18, 2026, the FBI, Japan’s National Police Agency, Australia’s Australian Cyber Security Centre, and Germany’s federal security agencies issued a joint advisory about a North Korean state-sponsored group called WaterPlum. Between December 2025 and July 2026, the group infected more than 30,000 devices across 100 countries and stole $10.71 million from roughly 7,000 cryptocurrency wallets, not through a zero-day exploit, but through fake job interviews. For Canadian security and IT leaders, the most important part of this story is not the cryptocurrency theft. It is what the campaign reveals about where security awareness training stops.
How a Job Interview Becomes a Breach
WaterPlum operatives, also known in earlier research as Contagious Interview, build convincing recruiter profiles on professional platforms such as LinkedIn and job boards, then approach software developers, web designers, and blockchain specialists with attractive opportunities. After initial contact, the fake recruiter schedules a video interview and asks the candidate to download and complete a technical coding task as part of the hiring process.
The file is BeaverTail, a JavaScript-based information stealer. Once installed, it harvests browser credentials, authentication tokens, and cryptocurrency wallet data from the victim’s device before dropping a Python backdoor called InvisibleFerret, which gives the attacker persistent remote access. The advisory notes that some interviewers used AI face-swapping software at the start of calls before claiming technical problems and switching to audio only, a detail that underscores how carefully this social engineering is staged. WaterPlum operates under Bureau 313, the weapons-production arm of North Korea’s Workers’ Party, framing these thefts as state revenue generation.
For any organization thinking about how human risk management fits into its security strategy, this campaign is a clear signal that the threat does not begin at the corporate perimeter.
Why Your Training Program Is Missing This
According to the 2026 Verizon Data Breach Investigations Report, 41 percent of social engineering breaches now involve non-email vectors, including voice calls, text messages, and professional platforms. The inbox-centric security awareness training model, which has been the industry standard for two decades, is increasingly a partial answer to a much broader question.
Most training curricula cover how to spot a suspicious email, avoid a phishing link, and verify an unexpected request from a known sender. Almost none cover the scenario where a recruiting message on a professional platform asks you to run an NPM package as part of a technical assessment. The WaterPlum campaign worked because the social context, a job interview with a credible recruiter, is one employees are conditioned to take seriously.
What We See in Our Client Work
In our work with mid-market Canadian enterprises, we consistently see security awareness programs that exist on paper but never reach the front-line employees who actually face the attacks. The WaterPlum campaign sharpens that gap. Developer and IT staff are often excluded from training programs on the assumption that they are already technically sophisticated. That assumption is exactly what this campaign exploits.
The Practical Next Step
The advisory’s most actionable guidance is straightforward: no one should download and run code, install packages, or execute scripts from an interview process on any device that touches corporate accounts or networks, including personal devices with work email or cloud storage access. This should be a written policy, not just a caution.
Organizations that run phishing simulations that reflect how social engineering actually works today should consider adding a recruitment-themed scenario for technical staff. A realistic outreach from a fake recruiter asking a developer to clone a repository is a low-cost test that reveals whether the gap is real before an actual campaign does.
For organizations that are not sure where their current training program leaves off, the right first step is a clear-eyed assessment of where your human-risk exposure actually sits before the next joint advisory names a campaign that has already been inside your environment for months.
Sources
- FBI IC3, Japan NPA, Australia ACSC, Germany BKA: Joint Cybersecurity Advisory on WaterPlum (North Korean Contagious Interview), September 18, 2026
- Forbes: “North Korea Shock: Fake Job Interviews Drain $10.7M From 7,000 Wallets,” Boaz Sobrado, September 19, 2026
- Verizon: 2026 Data Breach Investigations Report
- Australian Cyber Security Centre (ACSC): Advisory on North Korean WaterPlum Cyber Actor Group, September 18, 2026
