North Korean Hackers Resurface with Fake Job Interview Attack Targeting Over 3,100 IP Addresses

January 22, 2025: North Korean hackers—linked to the theft of over $2 billion from the cryptocurrency market in 2025—have resurfaced. A hacking group called PurpleBravo launched a large-scale fake recruitment drive targeting more than 3,100 internet addresses tied to firms in artificial intelligence, cryptocurrency, and financial services. Posing as recruiters or developers, the attackers directed job candidates to complete technical interview tasks—including code reviews, repository cloning, or coding exercises—leading to malicious code executing on corporate devices. To date, 20 organizations across South Asia, North America, Europe, the Middle East, and Central America have been confirmed as victims. Researchers discovered the group used forged Ukrainian identities to obfuscate their activity, while deploying two remote access trojans: PylangGhost and GolangGhost, which stole browser credentials. They also weaponized Microsoft Visual Studio Code (VS Code) to implant backdoors via malicious Git repositories.