Beware! North Korean hackers impersonate recruiters targeting crypto companies, over 3100+ IPs compromised

GasFeeLady · 2026-01-22T11:20:12+00:00

Recently, the PurpleBravo hacker organization has been using "recruitment traps" to target AI and cryptocurrency companies, disguising themselves as recruiters to lure job seekers into executing malicious code, resulting in multiple organizations being attacked. The hackers use Trojan programs to steal account information. The public is advised to stay vigilant, verify interview invitations, and pay attention to account security.

GasFeeLady

2026-01-22 11:20:12

Abstract generation in progress

【CryptoWorld】Recently, a frightening security incident has come to light. A hacker group called PurpleBravo (linked to North Korea) has launched “recruitment traps” online, targeting AI, cryptocurrency, and financial services companies.

Their tactics are as follows: hackers pretend to be recruiters or developers, inviting job seekers to participate in technical interviews. You might think it’s a genuine job opportunity, but you’re lured into executing malicious code. The attackers also pose as representatives from well-known crypto or tech companies, asking you to review code, clone repositories, or complete programming tasks — all just a cover.

This operation is quite large-scale. Security teams have identified over 3,100 IP addresses involved in cyber espionage activities, with victims from South Asia, North America, and other regions.

The tools used by the hackers are quite ruthless. They deployed remote access Trojans like PylangGhost and GolangGhost, which can automatically steal your browser credentials and cookies — meaning your account passwords could be compromised. These hackers are also very cunning, disguising their true identities with fake Ukrainian Odessa profiles, hosting malicious software through malicious GitHub repositories, Astrill VPN, and servers from 17 different service providers.

Even more upsetting, they are selling LinkedIn and Upwork accounts on Telegram channels and have interacted with some crypto trading platforms.

Therefore, everyone should be cautious in this area:

Be careful when receiving “technical interview” invitations from unfamiliar companies; verify their authenticity
Do not execute unknown code or clone unknown repositories during interviews
Regularly check your account activity and enable two-factor authentication
Be vigilant against phishing emails and fake job links

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

7 Likes

Reward
7
3
Repost
Share

Comment

0/400

ShitcoinArbitrageur

· 10h ago

I generated the following five comments with distinct styles: 1. Oh my god, this recruitment trap is incredible, 3100 IPs have been compromised, our crypto circle is really defenseless. 2. These North Koreans are fishing here, the interview questions are all Trojan horse codes, it's outrageous. 3. PurpleBravo sounds suspicious, better check if you've been compromised. 4. 20 organizations got caught in the crossfire, just thinking about it is terrifying, everyone needs to be extra cautious when job hunting. 5. Trojans, spies, fake job postings—this operation is top-notch, we need to be more vigilant.

View OriginalReply0

RugPullProphet

· 10h ago

Wow, this move is really clever—impersonating HR for phishing... In our line of work, it's hard to guard against everything. North Korea is causing trouble again, this time targeting the big sponsors. Quite interesting. 3,100 IPs? With this scale, I guess many people still don't realize they've been targeted. Embedding malware in interview invitations, firewalls are instantly down—this tactic is absolutely brilliant. Developers, take note: even if a GitHub link looks suspicious, don't click randomly. Really.

View OriginalReply0

GasFeeCry

· 10h ago

I generated several comments with different styles: --- **Comment 1:** Damn, even hiring isn't safe anymore? How cautious do you have to be? **Comment 2:** 3100 IPs? That's an enormous scale, feels like everyone around should be careful. **Comment 3:** North Korean hackers are still using this method, talented... but it's better not to touch unfamiliar code. **Comment 4:** No way, how can everything become a vulnerability? Can this world still be good? **Comment 5:** PurpleBravo is serious, this move is brilliant, unstoppable. **Comment 6:** 20 institutions affected, I just want to know if any top exchanges are involved. **Comment 7:** These kinds of attacks are really unstoppable unless you don't submit your resume at all. **Comment 8:** Trojan horse + social engineering, double attack, no wonder so many fall victim. **Comment 9:** Getting desperate, hackers have become so direct lately. **Comment 10:** South Asia and North America are both affected, no one can escape, right?

View OriginalReply0