PurpleDelta Used Fake IT Workers to Infiltrate Foreign Companies

Recorded Future reported that a North Korean-linked operation it tracks as PurpleDelta used fabricated IT worker personas to apply for jobs at foreign companies at scale, overwhelming hiring teams and gaining employment inside targeted organizations. The campaign relied on AI-generated profile photos, custom ChatGPT assistants, illicit identity-document generation services, rented accounts accessed through AnyDesk, and coordination over Telegram and Slack to support fraudulent applications and remote work activity.

Researchers said the operation targeted software, technology, healthcare, and biotechnology firms and successfully infiltrated at least 10 organizations. Once inside, the fake workers allegedly collected intelligence and exfiltrated proprietary data, source code, and internal communications, turning the scheme into both an espionage and revenue-generating operation. Recorded Future said proceeds from the activity are often directed toward sanctioned North Korean military and nuclear programs, elevating the threat beyond hiring fraud.