source_3935.pdf (3 MB)

Recorded Future links PurpleDelta to a state-directed network of North Korean IT workers that used at least 22 fabricated personas to apply to more than 1,100 companies and likely obtained employment at ten or more organizations. Operators combined illicit identity documents, AI-generated photographs, custom ChatGPT assistants, live transcription, multi-account browsers, and facilitator-maintained laptops to defeat remote-hiring controls. Once hired, they recorded internal meetings, retained access through personal or remotely managed devices, and coordinated work through Telegram and Slack, creating risks to source code, proprietary data, and internal communications. The activity remains ongoing and is likely to expand as inexpensive AI and identity services make compromised personas easy to replace.