North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews

"As many as 3,136 individual IP addresses linked to likely targets of the Contagious Interview activity have been identified, with the campaign claiming 20 potential victim organizations spanning artificial intelligence (AI), cryptocurrency, financial services, IT services, marketing, and software development sectors in Europe, South Asia, the Middle East, and Central America. The new findings come from Recorded Future's Insikt Group, which is tracking the North Korean threat activity cluster under the moniker PurpleBravo."

"The disclosure comes a day after Jamf Threat Labs detailed a significant iteration of the Contagious Interview campaign wherein the attackers abuse malicious Microsoft Visual Studio Code (VS Code) projects as an attack vector to distribute a backdoor, underscoring continued exploitation of trusted developer workflows to achieve their twin goals of cyber espionage and financial theft. The Mastercard-owned company said it detected four LinkedIn personas potentially associated with PurpleBravo that masqueraded as developers and recruiters"

Recorded Future's Insikt Group attributes the activity cluster to PurpleBravo, a North Korean-linked group also tracked as CL-STA-0240 and DeceptiveDevelopment. As many as 3,136 individual IP addresses were targeted between August 2024 and September 2025, concentrated in South Asia and North America. The campaign claimed 20 potential victim companies across Belgium, Bulgaria, Costa Rica, India, Italy, the Netherlands, Pakistan, Romania, the U.A.E., and Vietnam, spanning AI, cryptocurrency, financial services, IT services, marketing, and software development. Attackers employed malicious Visual Studio Code projects, fake LinkedIn personas, malicious GitHub repositories, and job-seeker lures to deliver backdoors for espionage and theft.

Read at The Hacker News