North Korea’s Fake Job Interviews: The WaterPlum Advisory

This week, Sherri and Matt dig into a joint advisory from seven government agencies across Japan, the US, Australia, and Germany naming WaterPlum, the North Korean actors posing as prospective employers to target software developers and IT professionals.

Japan’s National Police Agency reports at least 30,000 infected devices in more than 100 countries between December 2025 and July 2026, with funds or credentials taken from more than 7,000 cryptocurrency wallets and roughly $10.71 million moved to North Korea. Sherri and Matt break down how the lure works, why coding challenges are such an effective delivery mechanism, and what changed with the newest malware family, StoatWaffle, which can execute when a trusted folder is opened in VS Code. They connect it to the case LMG’s Tom Pohl analyzed in June and examine how North Korea is now working both sides of the hiring table, as both interviewer and applicant.

Key Takeaways:

Make onboarding a security checkpoint. Identity verification should be an HR and IT project. Verify every new hire’s identity, issue fresh credentials, and monitor accounts closely during the first few weeks. A compromised candidate can bring an existing infection into your organization on day one. Because the same operation also uses fake applicants, verify claimed locations, IP addresses, and résumé skills.

Treat password reuse as a policy issue, not a question. The malware Tom analyzed harvested saved credentials from ten different browsers. Require unique corporate passwords, audit them against known-breach lists, and use phishing-resistant MFA. Anyone with source code or administrative access should be considered for hardware-based authentication such as a YubiKey.

Keep developers off personal devices. Personal laptops often combine job hunting, coding challenges, credentials, and crypto wallets. In one case Tom analyzed, the person infected wasn't even the primary laptop user. Require company-managed devices for anyone accessing code, cloud infrastructure, or production systems. If personal-device use is allowed, document it as an accepted risk.

Extend security requirements to vendors and contractors. Your organization can be compromised through someone else's developer. Bybit lost roughly $1.5 billion after a developer at its wallet vendor was compromised. Ask vendors: Do developers use managed devices? How are they trained on fake-recruiter and malicious-package attacks? How do they prevent password reuse? How do they vet employe