# Joint advisory says WaterPlum infected 30,000 devices

_Published Saturday, September 19, 2026 at 11:06 AM EDT · Security · Latest · Tier 1 — Major_

![Joint advisory says WaterPlum infected 30,000 devices — Primary](https://www.bleepstatic.com/content/hl-images/2024/08/12/north-korean-hackers.jpg)

A joint advisory from Japanese, U.S., Australian and German authorities says the North Korean-linked WaterPlum group compromised at least 30,000 devices in more than 100 countries from December 2025 through July 2026.

The agencies say the group transferred cryptocurrency worth more than $10.7 million to North Korea. WaterPlum allegedly used fake recruiting approaches, malicious npm packages and coding-test lures to install malware that steals credentials, crypto assets and documents. The advisory also warns that compromised access can be used to reach employers' or clients' networks.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/)

---
Canonical: https://techandbusiness.org/newswire/uNDhQNcbEaqBmP5Uz4p_Dx
Published: 2026-09-19T15:06:59.840Z
Story chronology: 2026-09-19T14:05:15.000Z
Retrieved: 2026-09-19T16:59:18.535Z
Publisher: Tech & Business (techandbusiness.org)