CyberPrism.App

Pause execution, verify the sender independently, and preserve the assignment for security review. If suspicious code already ran, stop using the device for sensitive work and contact your incident-response team.

The September 18, 2026 joint advisory identifies WaterPlum, commonly called Contagious Interview, as a North Korean actor targeting developers through fake employment opportunities. It describes malicious coding assignments and supposed video-call fixes—a timely scenario for a September 24 developer security review. [Joint advisory](https://www.ic3.gov/CSA/2026/260918.pdf).

Use contact details obtained from the employer's official website to confirm the role and assessment. Ask whether the repository and any requested software are part of its recruitment process.

Suggested team rule: requests to disable protection, install an unfamiliar meeting tool, or paste unexplained commands go to security before execution. Save the messages and links so reviewers can assess the actual request.

Keep an unfamiliar repository outside trusted parent folders and confirm Restricted Mode is active. VS Code documents that parent-folder trust extends to subfolders; Restricted Mode limits tasks, debugging, settings, and extensions that can execute code. [Workspace Trust documentation](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust).

The WaterPlum advisory specifically recommends inspecting .vscode/tasks.json for download or execution instructions. Review that file without enabling workspace trust to make the assignment run. [Advisory mitigations](https://www.ic3.gov/CSA/2026/260918.pdf).

Suggested review record: repository URL, commit identifier, setup instructions, package scripts, and unexplained downloads. Route unresolved behavior to a security analyst before approving execution.

The advisory recommends disconnecting a suspected infected device from the internet and cautions that removing malware does not establish that data stayed private. Follow your organization's containment and evidence-preservation process. [Advisory response guidance](https://www.ic3.gov/CSA/2026/260918.pdf).

For the incident handoff, record when the project was opened, whether trust was enabled, and which commands ran. Have responders inventory work accounts, repository tokens, SSH keys, and cloud credentials accessible from that device, then decide which credentials and sessions require revocation.

Separate three findings: code execution confirmed, sensitive access possible, and data transfer observed. Give each unresolved finding an evidence source, owner, and next review time.

Suggested hiring-team practice: publish the assessment process, identify approved repository owners, and provide a contact candidates can verify independently. Offer an alternative when an assignment would require running unfamiliar code on a device containing work credentials.

For leadership, report affected developers, containment status, exposed access under review, and the decision needed next. Keep campaign attribution separate from confirmed findings about your environment.