WaterPlum campaign hits 30,000 devices

US, Japanese, Australian, and German authorities say North Korea-linked WaterPlum compromised at least 30,000 devices in more than 100 countries, touched over 7,000 crypto wallets, and moved ¥1.7 billion ($10.71 million) in stolen crypto between December 2025 and July 2026. The FBI’s joint cybersecurity advisory and BleepingComputer’s report frame it as recruitment fraud with consequences for employers, candidates, and client networks. Treat remote hiring as an identity-and-access control problem, not only an HR check; the archive’s prior agent-security analysis makes the same case for minimizing trust in AI-adjacent workflows.