Joint advisory says WaterPlum infected 30,000 devices

A joint advisory from Japanese, U.S., Australian and German authorities says the North Korean-linked WaterPlum group compromised at least 30,000 devices in more than 100 countries from December 2025 through July 2026. The agencies say the group transferred cryptocurrency worth more than $10.7 million to North Korea. WaterPlum allegedly used fake recruiting approaches, malicious npm packages and coding-test lures to install malware that steals credentials, crypto assets and documents. The advisory also warns that compromised access can be used to reach employers' or clients' networks.