Photo
click to show
click to show
The job interview was the payload.
North Korea’s WaterPlum crew, also called Contagious Interview. Fake recruiter. AI face on camera. A few minutes of video. Then the cam dies. “Bad connection.”
Next step is a coding test you download. That is the malware.
Japan, the US, Australia, Germany put it in writing. Dec 2025 to July 2026. At least 30,000 boxes in over 100 countries. Credentials or funds from more than 7,000 wallets. About $10.7 million moved to the regime.
They impersonate AI and crypto firms. They want seeds, browsers, IDs. Then a path into whoever hires you.
If the interviewer goes dark and asks you to run a file, that is not a glitch. That is the job.
16 ·