WaterPlum is NTT Security Japan’s designation for a North Korea-linked actor also called Famous Chollima and PurpleBravo. The group targets financial institutions, cryptocurrency operators, and financial-technology companies worldwide and has conducted the Contagious Interview campaign since around 2023. Its operators approach targets through fraudulent employment scenarios and deploy cross-platform malware including BeaverTail, InvisibleFerret, and the actively developed OtterCookie family. OtterCookie versions observed from September 2024 through April 2025 expanded from basic file theft into Windows and macOS credential collection, browser and cryptocurrency-data theft, clipboard monitoring, shell-command execution, and sandbox detection. Later variants harvested Chrome passwords through Windows data-protection interfaces and collected MetaMask, Brave, Chrome, document, image, and macOS credential material. WaterPlum’s campaigns combine recruiter-style social engineering with rapid malware iteration to compromise developers and organizations possessing access to cryptocurrency, source code, credentials, and financially valuable systems.