WaterPlum Hackers Compromise 30,000 Devices in Massive Supply Chain Attack
Between December 2025 and July 2026, the North Korean hacking group WaterPlum executed a sophisticated supply chain attack through their "Contagious Interview" campaign, compromising over 30,000 devices across more than 100 countries. The attackers impersonated legitimate AI, cryptocurrency, and NFT companies to target job seekers with malicious npm packages and fake coding tests, ultimately stealing cryptocurrency credentials from over 7,000 wallets and transferring $10.7 million to North Korea. The operation combined social engineering with multiple malware families including BeaverTail, InvisibleFerret, and StoatWaffle to conduct financial theft and espionage. This incident highlights the evolving sophistication of state-sponsored supply chain attacks that exploit trusted development environments and social engineering tactics, demonstrating how nation-state actors are increasingly targeting individual developers and IT professionals to fund weapons programs while simultaneously infiltrating corporate networks.
Kill Chain
