North Korean hackers make a comeback, attacking over 3,100 IP addresses using fake job interview scams

2026-01-22 11:24:28

Abstract generation in progress

BlockBeats News, January 22 — After stealing over $2 billion from the cryptocurrency market in 2025, North Korean hackers are making a comeback. A hacking group called PurpleBravo has launched a large-scale fake recruitment campaign, targeting over 3,100 internet addresses related to artificial intelligence, cryptocurrency, and financial services companies. The attackers impersonate recruiters or developers,诱导 job seekers to perform technical interview tasks, including reviewing code, cloning code repositories, or completing programming assignments, thereby executing malicious code on corporate devices. Currently, 20 organizations from South Asia, North America, Europe, the Middle East, and Central America have been confirmed as victims.

Researchers found that North Korean hackers used forged Ukrainian identities to conceal their activities and deployed two remote access Trojans, PylangGhost and GolangGhost, to steal browser credentials. Additionally, they developed weaponized Microsoft Visual Studio Code, implanting backdoors through malicious Git repositories.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.