A North Korean hacking group is using job ads to harvest sensitive information from unsuspecting applicants from more than 100 countries, authorities warn.<\/p>\n
The group, known as “WaterPlum”, infiltrated at least 30,000 devices stealing $US10.71 million ($15.25 million) worth of cryptocurrency from 7,000 accounts.<\/p>\n
Cybersecurity officials<\/a> from the US, Japan, Germany and Australia issued a joint statement saying the group was targeting individual IT professionals.<\/p>\n What happened?<\/p>\n Between December 2025 and July this year, members of WaterPlum presented as an employer advertising fake roles specifically for software developers and IT professionals.<\/p>\n They would instruct applicants to download files for software alternatives to video conferencing apps such as Zoom to conduct interviews.<\/p>\n Authorities said members of the group also operated as North Korean IT workers at companies.<\/p>\n They would use artificial intelligence (AI) face-swapping software when beginning online interviews for roles, and then ask to disable their camera “because of network issues”.<\/p>\n FBI says North Korea stole $US1.5b in crypto<\/a><\/p>\n A $US1.5 billion heist on leading cryptocurrency exchange Bybit is the work of North Korean state-sponsored hackers, according to the FBI.<\/p>\n It was discovered after Japanese authorities were able to identify a “laptop farm”, which obscures someone’s real location, and found evidence WaterPlum had transferred millions in cryptocurrency to places outside Japan.<\/p>\n Those who were a part of the laptop farm were often located in North Korea, China and Russia, with a small number in Africa and south-east Asia.<\/p>\n University of Melbourne’s Andrew Cullen, who specialises in cybersecurity and AI, said these were two of the main types of scams run by the group.<\/p>\n He said he had seen reports of fake North Korean employees for the last three to four years but it has been accelerating.<\/p>\n “I don’t think anybody in the West has a particularly strong grasp on exactly how long this has been happening,” Dr Cullen said.<\/p>\n He said it was difficult to understand the scale of the problem, especially as it related to workers infiltrating companies, because that information was rarely disclosed.<\/p>\n “It’s really hard for governments and cybersecurity organisations to try and collect this large-scale data to show how much of a problem it is across the economy,” he said.<\/p>\n Authorities said the group had also been able to access ID images, passwords and other sensitive data from thousands of people that could be used for extortion.<\/p>\n They also said the group operated under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers’ Party of Korea.<\/p>\n What does it mean?<\/p>\n Dr Cullen said hacks of this nature were likely to become more prevalent because of rogue AI agents and AI tools that enable hackers to work faster with a larger scope.<\/p>\n