FBI and Global Agencies Warn Over WaterPlum Crypto Job Scam
The FBI, US DoD, and international law enforcement issued an alert over the WaterPlum campaign, which has stolen over $10.5 million in crypto from job seekers.
FBI and US DoD Issue Warning Over WaterPlum Crypto Scam
The FBI and the US Department of Defense, in cooperation with the National Police of Japan and law enforcement agencies in Australia and Germany, issued a joint alert regarding a threat group suspected of stealing over $10.5 million in cryptocurrency from job seekers through a campaign dubbed "WaterPlum". The attackers pose as artificial intelligence or blockchain companies to lure candidates into fraudulent recruitment processes.
According to the report, between December 2025 and July 2026, WaterPlum attackers infected at least 30,000 devices across 100 countries and stole funds or credentials from roughly 7,000 cryptocurrency wallets. Primary targets included web designers, engineers, and crypto experts. Candidates were recruited via social networks, freelance websites, and gig platforms, and during the "interview" process, applicants were asked to download files—a step that allowed attackers to infect the device and steal wallet access credentials and other data.
Malware Strains and North Korean IT Worker Link
Japanese police identified variants of the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware strains on victims' devices. Attackers typically installed infostealers and remote access tools to maintain persistence on the machines. In other cases, stolen identity documents from victims were used to present additional job applications under the victim's name.
"This campaign leverages the vulnerabilities of the global hybrid job market—remote interviews, freelance recruitment, and gig platforms—to finance state coffers while evading international sanctions."
The report links WaterPlum to the broader phenomenon of North Korean "IT worker schemes," where North Koreans steal or purchase identities to secure coveted tech jobs in US and European companies. According to the report, the WaterPlum campaign and IT worker schemes are operated via the Munitions Industry Department of North Korea, operating under the Central Committee of the Workers' Party.
