North Korean hackers make a comeback, attacking over 3,100 IP addresses using fake job interview scams

BlockBeats News, January 22 — After stealing over $2 billion from the cryptocurrency market in 2025, North Korean hackers are making a comeback. A hacking group called PurpleBravo has launched a large-scale fake recruitment campaign, targeting over 3,100 internet addresses related to artificial intelligence, cryptocurrency, and financial services companies. The attackers impersonate recruiters or developers,诱导 job seekers to perform technical interview tasks, including reviewing code, cloning code repositories, or completing programming assignments, thereby executing malicious code on corporate devices. Currently, 20 organizations from South Asia, North America, Europe, the Middle East, and Central America have been confirmed as victims.

Researchers found that North Korean hackers used forged Ukrainian identities to conceal their activities and deployed two remote access Trojans, PylangGhost and GolangGhost, to steal browser credentials. Additionally, they developed weaponized Microsoft Visual Studio Code, implanting backdoors through malicious Git repositories.