North Korean hackers posed as recruiters, infected 30,000 devices
From December 2025 to July 2026, the WaterPlum group posed as recruiters to infect developers' devices: 30,000 devices in 100+ countries and 7,000 crypto wallets were affected, with over $10 million stolen for North Korea. The FBI, the US Department of Defense and authorities in Japan, Australia and Germany issued a joint warning.
- 30,000 infected devices in more than 100 countries
- 7,000 crypto wallets compromised, over $10 million stolen
- Attacks ran from December 2025 to July 2026
- Malicious files were placed in NPM packages and code repositories
Read next
Security