Cybersecurity
Advisory says Contagious Interview hit 30,000 devices
A joint advisory from agencies in Japan, the U.S., Australia and Germany said North Korean actors used Contagious Interview to compromise devices, steal wallet access and drain cryptocurrency.
- Agencies in Japan, the U.S., Australia and Germany said the campaign had affected at least 30,000 devices in more than 100 countries and over 7,000 cryptocurrency wallets.
- They estimated the losses at at least $10.71 million in cryptocurrency.
- The actors targeted web designers, engineers and people working in cryptocurrency, blockchain and Web3 by posing as recruiters and steering them into job tests that installed malware.
- The alert said the activity was tracked under several community names and linked WaterPlum and some North Korean IT workers to the 313 General Bureau of the Munitions Industry Department.
- Silent Push said a North Korean IT worker used a Discord server called Mouse Review to recruit proxies for interviews and coding tasks.
A joint advisory from agencies in Japan, the U.S., Australia and Germany said North Korean actors behind the Contagious Interview campaign had compromised at least 30,000 devices in more than 100 countries. It said more than 7,000 cryptocurrency wallets had been affected and put the losses at at least $10.71 million.
The advisory said the targets were web designers, engineers and people working in cryptocurrency, blockchain and Web3. The actors were said to pose as employers or recruiters on social platforms, then send assignments that led to malware installation and remote access.
The alert said the activity was known by several community labels, including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi and WaterPlum. It also said WaterPlum and some North Korean IT workers were thought to sit under the 313 General Bureau of the Munitions Industry Department, and that a laptop farm in Japan had been found and dismantled.
The article then turned to the wider North Korean IT worker scheme, which used false identities to win jobs and earn foreign currency. Kudelski Security said the main targets appeared to be the U.S. and Japan, and Silent Push said a Discord server called Mouse Review recruited proxies for interviews and coding tests.
Named in this story
Companies
- DTEX
- backed a June 2025 assessment on the linkage
- Sekoia
- described the IT worker programme as an adaptation of older labour dispatch
- Kudelski Security
- said the main targets appeared to be the U.S. and Japan
- Silent Push
- said it found a Discord recruitment scam
Organisations
- Palo Alto Networks Unit 42
- first exposed the Contagious Interview campaign
- WaterPlum
- threat cluster linked to the campaign and the IT worker scheme
Governments and agencies
- 313 General Bureau of the Munitions Industry Department
- body suspected of overseeing the linked activity
Places
- Japan
- home country of one of the agencies issuing the advisory
- U.S.
- home country of one of the agencies issuing the advisory
- Australia
- home country of one of the agencies issuing the advisory
- Germany
- home country of one of the agencies issuing the advisory
How the source tells it
The piece was mostly a straight advisory, but it still leaned on scale and loaded labels to keep the threat frame prominent.
- alarm it used large victim counts and criminal wording to cast the campaign as a broad threat