North Korean hackers make a comeback, attacking over 3,100 IP addresses using fake job interview scams

On January 22, after stealing over $2 billion from the cryptocurrency market in 2025, North Korean hackers have made a comeback. The hacking group known as PurpleBravo launched a large-scale fake recruitment campaign, targeting over 3,100 internet addresses related to artificial intelligence, cryptocurrency, and financial services companies. The attackers impersonated recruiters or developers, tricking job seekers into performing technical interview tasks, including reviewing code, cloning code repositories, or completing programming assignments, thereby executing malicious code on corporate devices. Currently, 20 organizations from South Asia, North America, Europe, the Middle East, and Central America have been confirmed as victims. Researchers found that North Korean hackers used forged Ukrainian identities to conceal their activities and deployed two remote access Trojans, PylangGhost and GolangGhost, to steal browser credentials. Additionally, they developed weaponized Microsoft Visual Studio Code, implanting backdoors through malicious Git repositories.