International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data

North Korean threat actor WaterPlum is conducting a large-scale social engineering campaign targeting software developers and IT professionals via fake job postings in AI and crypto sectors. The group has compromised over 30,000 devices globally and stolen nearly $11 million in cryptocurrency. Our developers and IT staff are high-value targets for this operation.

CRITICALAdvisorySep 20, 2026

Action required

Immediately alert all developers and IT staff to verify job opportunities through official company channels only. Block known WaterPlum C2 infrastructure at perimeter. Hunt for suspicious process execution, credential theft indicators, and unauthorized crypto wallet access on developer workstations.

Affected products

FBIDepartment of Defense’s Cyber Crime Center

Linked articles

International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data

Source links

https://cyberscoop.com/north-korea-waterplum-job-seeker-crypto-attacks/