Business · Enterprise Risk
The Job Interview Can Be the Breach
By HSG Business Team · September 24, 2026
The next breach may arrive with a calendar invitation.
A technical interview can already require three meetings, a take-home assignment, and an explanation of where you see yourself in five years. Installing malware should not be the fourth round.
On September 18, 2026, agencies from the United States, Japan, Australia, and Germany released a joint advisory warning that this scenario was no longer hypothetical. The advisory identifies the North Korean cyber actor group as WaterPlum, commonly referred to as ‘Contagious Interview.’ And this is not ordinary cybercrime dressed up as recruiting. The FBI and Japan’s National Police Agency assess that WaterPlum and some North Korean IT workers operate under North Korea’s 313 General Bureau, part of its Munitions Industry Department. [1]
The quantified scope covers a window spanning December 2025 through July 2026. During that period, WaterPlum infected at least 30,000 devices in more than 100 countries and transferred funds or account credentials from more than 7,000 cryptocurrency wallets, exfiltrating at least $10.71 million in cryptocurrency. [2]
The attack chain exploits a specific psychological friction: the gap between professional ambition and security caution. Attackers impersonate prospective employers or recruiters on platforms candidates already trust for job searching. They turn familiar technical tasks into the trap: open the project, download the package, run the code, troubleshoot the interview software. The attacker does not have to defeat the firewall if a trusted professional interaction persuades someone to execute the payload voluntarily.
The malware is the mechanism. Trust is the vulnerability.
Technical controls can disrupt parts of the attack chain. They cannot eliminate the trust problem that gets the victim to execute the code in the first place. Defenders must connect human verification with technical safeguards such as endpoint detection and response (EDR), sandboxed or isolated environments, restricted execution, and other endpoint protections. Leaders need to assess how their people handle high-trust interactions outside organizational boundaries without treating career exploration as disloyalty.
For years, organizations have been warned about the fake applicant. WaterPlum flips the threat model: this time, the employer is fake. Compromised credentials or devices can create a pathway toward the victim’s employer, particularly where personal and organizational access overlap. This is not a claim that every infected personal device automatically compromises an employer, but it establishes a credible risk vector for those who use personal hardware to access sensitive corporate environments. [1]
To reduce exposure without stopping legitimate opportunities, organizations should equip staff with four questions to ask when an assignment arrives from an external source:
- Who independently verified the person and organization? A recruiter’s profile may look legitimate. The company name may be real. The opportunity may appear perfectly plausible. None of those facts independently establishes who is actually making the request.
- Is the requested action proportionate to the stated purpose? Does a routine interview really require you to install an unfamiliar package, open an untrusted repository, or run a command on a machine containing sensitive information?
- What device, credentials, data, or access would the action expose?
- Where can someone raise a concern without embarrassment or career consequences? People will not report anomalies if doing so risks their standing in a competitive hiring process.
Technical behavior alone does not establish who is making the request or why. At HSG, the question is not simply whether a request looks legitimate, but what evidence supports the identity, purpose, and access being requested. Turning scattered information into a sourced assessment is where organizations often fail.
The goal is not to treat every recruiter, interview, or coding exercise as hostile. It is to stop confusing familiarity with verification. When an external request involves executing code, installing software, exposing credentials, or granting access, legitimacy should be established before trust becomes action.
Legitimate opportunity should not require abandoning judgment. The WaterPlum campaign succeeds because it leverages the trust people place in their own career advancement. Defending against this threat starts with recognizing that the interview process itself is part of the perimeter.
The perimeter no longer begins at login. Sometimes it begins with, “We’d like to schedule an interview.”
Request a Decision Defensibility Briefing