Executive Summary
Insikt Group has identified multiple clusters of PurpleDelta activity, Recorded Future's designation for North Korean IT workers. Between late 2024 and early 2025, these operators applied to over 1,100 companies primarily in North America, leveraging at least 22 fabricated personas supported by AI-generated imagery and custom ChatGPT assistants. The group shows high operational tempo, sometimes submitting 60+ applications per day across multiple job platforms while coordinating through facilitators based in China and other regions.
The technical tradecraft involves using multi-account management browsers, remote desktop tools like AnyDesk to access hardware maintained by local facilitators, and real-time AI transcription tools to cheat during technical interviews. Beyond revenue generation, there is significant risk of insider threats, as operators have been observed recording internal meetings and coordinating with threat clusters like PurpleBravo, who deploy malware such as BeaverTail. The activity presents a material risk to the technology, healthcare, and financial sectors.
Organizations hiring for remote roles must implement rigorous identity verification, as PurpleDelta has adapted to video interview requirements by using face-swapping technology and AI-generated scripts to maintain their cover. The scale and sophistication of this operation suggest a mature, state-directed effort that continues to evolve despite public exposure.