# WaterPlum Targeted Developers via Fake Job Interviews > Source: > Published: 2026-09-18 15:08:14+00:00 North Korea got formally named today. Japan’s National Police Agency, the US FBI, and agencies from Australia and Germany jointly attributed the “WaterPlum” hacker group — also called Contagious Interview — to North Korea’s 313th Bureau of Munitions Industry Department. Their campaign ran December 2025 through July 2026, infected over 30,000 developer machines across 100+ countries, drained 7,000 crypto wallets, and cleared $10.71 million. The entry point in most cases: a fake job interview and a GitHub link. ## How Opening a Folder Can Own Your Machine The VSCode angle is the part most coverage has underplayed. WaterPlum’s newer attack vector doesn’t require you to run anything manually. Attackers send a “test project” link — a GitHub repo that looks like a blockchain SDK or AI toolkit — and ask you to open it in VS Code as part of a technical assessment. Inside the repo is a hidden `.vscode/tasks.json` file. It contains one setting: `"runOn": "folderOpen"`. When you open the folder and mark the workspace as trusted — as most developers do reflexively — VS Code silently executes the task. No prompt. No visible terminal output. The task reaches out to a remote server, downloads StoatWaffle malware, and installs itself. StoatWaffle is a modular Node.js malware with two components: a stealer that grabs browser-saved credentials, crypto wallet browser extensions, and on macOS, the entire Keychain database; and a RAT that gives the attacker persistent remote access to your machine. This is not a VS Code vulnerability. It is a feature working as designed. Microsoft has known about this attack pattern since at least [GitHub Issue #309406](https://github.com/microsoft/vscode/issues/309406) and has not changed the default. The setting `task.allowAutomaticTasks` still defaults to on. Disable it now: ``` // VS Code settings.json "task.allowAutomaticTasks": "off" ``` ## The npm Package Track The VSCode trick is the newer method. The older one — malicious npm packages — has only gotten bigger. WaterPlum has published over 1,700 malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist since January 2025. The [latest wave uses 35 npm packages](https://www.bleepingcomputer.com/news/security/new-wave-of-fake-interviews-use-35-npm-packages-to-spread-malware/) specifically. The attack flow is the same: recruiter, technical assessment, “please clone this repo and run the tests.” You run `npm install`. BeaverTail drops. It steals your browser credentials and crypto wallet extension data, then silently installs InvisibleFerret — a Python backdoor that gives the attacker full remote command execution and exfiltrates session cookies. The [campaign now spans five package ecosystems](https://socket.dev/blog/contagious-interview-campaign-spreads-across-5-ecosystems). If you write Python, Go, or Rust, you are no longer out of scope. ## What They Actually Take The malware is not ransomware — it doesn’t announce itself. It is optimized for quiet extraction: - All browser-saved passwords (Chromium and Firefox profiles) - Crypto wallet browser extensions: MetaMask, Phantom, and others - macOS Keychain database (all stored credentials) - Browser session cookies (enables account takeover without needing your password) - Persistent RAT access for ongoing surveillance and re-exfiltration The [Microsoft Security Blog’s technical analysis](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/) documents the full exfiltration chain. The [FBI/IC3 joint advisory](https://www.ic3.gov/CSA/2026/260918.pdf) released today has the official attribution and IOC list. ## Check These Five Things Right Now If you’ve done a technical interview in the past nine months that involved running unfamiliar code: 1. **Disable VS Code automatic tasks:** Open Settings, search “automatic tasks,” set to*off* . Also add`"task.allowAutomaticTasks": "off"` to your`settings.json` . 2. **Audit VS Code Workspace Trust:** Go to*File → Preferences → Workspace Trust* and review which folders you’ve trusted. Distrust any you don’t recognize. 3. **Check your npm install history:** Review`~/.npm` and your project`node_modules` for packages you don’t recognize. Cross-reference against[Socket.dev](https://socket.dev) . 4. **Audit browser extensions:** Open your browser extensions list. Remove anything you don’t recognize, especially crypto wallet extensions you didn’t install yourself. 5. **Use a sandbox going forward:** GitHub Codespaces, a throwaway VM, or a Docker container with no home directory mounts — for any recruiter-provided code. Interview platforms like HackerRank or CoderPad are safer by design. ## The Broader Problem WaterPlum is one group. The fake-interview vector is not. Security researchers have documented multiple threat actors using variants of this approach. The common thread: developers are high-value targets (credentials, crypto, company access), and the hiring process creates a context where running unfamiliar code feels normal. It shouldn’t. Treat recruiter-provided code the same way you’d treat an executable from a stranger’s USB drive — it goes in a sandbox, not on your main machine. The [VS Code Workspace Trust documentation](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust) explains what the trust model actually covers. Most developers have never read it. Now is a reasonable time to start.