Recorded Future's Insikt Group uses PurpleDelta as its designation for clusters of North Korean IT workers operating a fraudulent employment scheme, comprising multiple operators likely based in China with a documented nexus to Shenyang. One cluster applied to more than 1,100 companies, mostly in software and technology, staffing and consulting, and healthcare and biotechnology, between late 2024 and early 2025. Operators maintained at least 22 fabricated personas supported by AI-generated photographs, custom ChatGPT assistants, illicitly obtained identity documents, anti-detect browsers, and temporary phone services, submitting dozens of applications daily and using live transcription and AI-generated answers to pass technical interviews; Recorded Future assesses operators were highly likely to have secured employment at ten or more organizations, creating insider risk through recorded meetings and continued personal-device access. Recorded Future notes overlap between PurpleDelta and the North Korean clusters Jasper Sleet, UNC5267, Wagemole, and Famous Chollima, as well as a related cluster, PurpleBravo, that delivers malware through fraudulent recruitment targeting cryptocurrency-sector developers, with proceeds ultimately supporting North Korea's sanctioned military and nuclear programs.