North Korean hackers attacked AI and encryption companies through fake interviews, affecting over 3,100 IP addresses.

The North Korean hacking group PurpleBravo launched a massive fake recruitment campaign, attacking over 3,100 IP addresses associated with companies in the AI, cryptocurrency, and financial services sectors. Attackers impersonated recruiters or developers on platforms like LinkedIn, luring job seekers to perform technical interview tasks on company devices. These tasks included reviewing code or cloning malicious Git repositories to deploy PylangGhost and GolangGhost remote access trojans to steal browser credentials. The operation has affected 20 organizations in South Asia, North America, and Europe. Research indicates the group used forged Ukrainian identities as a cover and weaponized Microsoft Visual Studio Code to implant backdoors. The group is also detected using Astrill VPN and C2 servers located in China to conceal its activities, which overlap with the activities of the Contagious Interview cluster.