← WaterPlum / Contagious Interviewreviewed 2026-10-28 · 8 claims checked
Fact-check findings
What an automated fact-checker found when it re-read WaterPlum / Contagious Interview against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #4[disputed][awaiting moderator]in the timeline
“2025-01-01”
reviewerA 2025 bitFlyer recruitment attempt by an applicant claiming Malaysian nationality (timeline date set to 2025-01-01).Reporting places the incident in May 2025, not January. A French-language report names bitFlyer, but CoinTelegraph, BleepingComputer and SecurityWeek do not. The 'Malaysian nationality', 'multiple VPNs' and 'cryptocurrency payment' details were not confirmed in any source I could read.Proposed correction (not yet applied)2025-05-01
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Attribution and State Sponsorship
“Prior to the joint advisory, the broader security research community had tracked the same group under the name Contagious Interview since approximately 2023”
reviewerContagious Interview has been tracked since about 2023, and also documented as early as 2022.The page says both 'since approximately 2023' and 'as early as 2022' without a clear reference. Public reporting I know of places the campaign's first documentation around late 2023. The 2022 claim in the timeline and sections[1] and [4] was not corroborated by anything I read.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Attribution and State Sponsorship
“A joint cybersecurity advisory published September 18, 2026 by seven agencies”
reviewerThe advisory was signed by exactly seven named agencies: NPA, NCO, FBI, DC3, ASD ACSC, BND and BfV.Date of September 18 and the four-country makeup are confirmed. The specific seven-agency roster (NCO, BND, BfV, ASD ACSC) could not be confirmed from reachable sources. The NPA PDF (npa.go.jp/bureau/cyber/pdf/20260918_j.pdf) was not read. No correction is proposed because the true roster is unverified. - #5[partially supported][awaiting moderator]in section: Campaign Scale and Financial Impact
“and that several hundred million yen had been transferred abroad through North Korean IT-worker employment operations operating within Japan”
reviewerNPA disclosed several hundred million yen transferred abroad through North Korean IT-worker employment operations in Japan.The amount is right, but SecurityWeek attributes it to the group's crypto thefts, not to IT-worker employment. The Japan laptop-farm takedown is confirmed by the SecurityWeek headline. - #8[partially supported][awaiting moderator]in section: Ongoing Threat and Current Risk to Crypto Industry
“All government advisories issued as of September 2026 describe the campaign as ongoing.”
reviewerThe advisory states the campaign is ongoing and recommends specific protective measures such as restricted mode, the VM advice and the command indicators.Ongoing status is plausible, but 'all government advisories' is broader than what I checked. Timeline[6] says the FBI 'publicly confirm[s]' the campaign is ongoing on 2026-09-21. That was not seen in the sources I could read, and the Daily Hodl source was not fetched.
confirmed
3 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Campaign Scale and Financial Impact
“According to the September 18, 2026 joint government advisory, WaterPlum infected at least 30,000 devices across more than 100 countries between December 2025 and July 2026.”
reviewerWaterPlum infected 30,000+ devices in 100+ countries between December 2025 and July 2026, with funds or credentials taken from 7,000+ wallets and about 1.7 billion JPY (about $10.71M) transferred to North Korea.Figures are consistent across BleepingComputer, CoinTelegraph and search summaries. - #2[confirmed][no action needed]in section: Attribution and State Sponsorship
“The agencies assess that WaterPlum operators and associated North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department”
reviewerWaterPlum operators and some DPRK IT workers operate under the 313 General Bureau of the Munitions Industry Department.Supported by secondary reporting. The primary cyber.gov.au page was not readable. Reporting attributes the assessment to the FBI and NPA specifically. - #6[confirmed][no action needed]in section: Malware Arsenal: Five Named Families
“The joint advisory and associated security research identify five distinct malware families deployed by WaterPlum.”
reviewerFive malware families (BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle) are named.Family names match. The per-family technical descriptions were not individually verified.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.