Keep Interviews Outside Production
Joint agencies attribute WaterPlum, also called Contagious Interview, to North Korean operators. Their December 2025 to July 2026 campaign assessment records 30,000 or more compromised machines in over 100 nations, funds or credentials taken from over 7,000 crypto wallets and transfers of US$10.71m or more. These accumulated figures neither date every infection to publication nor establish that each wallet lost money.
Microsoft independently documents malicious packages, repository tasks and bogus conferencing repairs during interviews. Personal devices may expose browsers, wallets, source code, package registries, cloud and deployment systems, SSH keys and employer credentials. Willing execution can provide access without exploiting a flaw.
Plausible profiles and company pages supply social proof, not authentication. The FBI's recruitment-fraud guidance describes cloned listings and real employees' identities used to deceive candidates. A convincing conversation cannot establish who supplied an assignment.
Response
- Assess unfamiliar code in a disposable virtual machine, excluding employer credentials and mounted secrets.
- Decline recruiter-supplied codecs, extensions or meeting fixes; open a known conferencing service independently.
- Read dependencies, installation scripts, build hooks and copied commands before running them.
- Protect publishing accounts with phishing-resistant multifactor authentication; keep maintainer identities separate from everyday browsing.
- Verify the employer through its independently found domain and staff directory.
- After execution, disconnect and tell the employer immediately if work credentials or repositories were available. Personal cleanup cannot establish that organisational exposure has ended.
Recruitment should not inherit the device, secrets and identities used to publish software or transfer money.
Sources
The joint landing page was published and reviewed on 22 September 2026; its document is dated 18 September. Neither supplies a publication time.
