Four governments trace 30,000 infected devices to fake interview coding tasks

The two delivery paths need different controls. A malicious npm package needs an install step, and the advisory names BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle as arriving that way ^[7]. StoatWaffle also ships as a VS Code project whose code executes automatically once the project is trusted ^[7]. That path leaves defenders no install step to catch. The administrator indicator list accordingly puts trusted VS Code workspaces alongside unapproved npm packages, execution from external repositories and unknown Node.js or Python processes ^[10].

On the endpoint, the listed signals are npm install executions, Node.js or Python child processes, automated VS Code task execution, and heavy access to browser data or crypto wallets ^[11]. The discriminator is provenance: the proxy, gateway and DNS section points at retrieval of unknown packages from sources like GitHub and Bitbucket, and connections to command-and-control infrastructure ^[21].

December 2025 to July 2026 is eight months, so at least 30,000 devices works out to roughly 3,750 new infections a month ^[18]. Spread 1.7 billion JPY across more than 7,000 wallets and the average take is about 243,000 JPY per wallet ^[17]. That per-wallet average is not a per-victim average, because the agencies counted wallets and one device can hold several ^[3].

The theft totals describe a victim population selected for holding cryptocurrency, so they transfer to an employer only if its developers keep wallets on the machines they work from. Persistence works regardless of where the wallets sit. The advisory says the malware runs on applicants' personal or development devices and reaches corporate environments through established connections and employment access ^[19], and that the actors keep that access, creating opportunities to compromise the companies or contractors where victims work ^[9]. The number of successful corporate compromises has not been disclosed ^[9].

The recommended fix is to execute task code in an isolated sandbox, kept separate from devices holding personal assets and corporate credentials ^[12]. Building it falls to the applicant, doing unpaid work on their own hardware.

The employer-side controls sit in recruiting: identity, location, credentials, IP addresses and payment destinations verified through multiple paths, with least privilege strictly enforced ^[13]. Those address the second campaign in the same document, in which operators use fake resumes, VPNs, AI-driven face, voice and translation support, and laptop farms run by local accomplices to get hired for access and pay ^[14]. The advisory says that vector does not always coincide with the malware infections ^[14]. For it, the identity-layer indicators are new sessions originating from victim devices and logins from unusual countries or VPS providers ^[20].