PurpleDelta

PurpleDelta is Recorded Future Insikt Group’s designation for North Korean IT workers conducting a remote IT employment fraud scheme (also referred to as Wagemole) in which operators seek unauthorized employment—often at US firms—using fraudulent, stolen, or “loaned” identities, including synthetic personas built across platforms such as LinkedIn, GitHub, and job boards. The activity is assessed to be conducted for both financial gain and espionage, and reporting cited the use of deepfake injection techniques to pass remote hiring processes. Content states this scheme has infiltrated at least 64 US companies and can generate significant revenue per operator. Insikt Group reports multiple points of operational and infrastructure overlap between PurpleDelta and the North Korea-linked ‘Contagious Interview’ activity cluster it tracks as PurpleBravo, including shared Astrill VPN-linked infrastructure/nodes, administration traffic overlaps, and instances suggesting the same devices/operators were involved in both IT-worker job-fraud activity (e.g., automating job applications) and malware C2 operations. This overlap is highlighted as a supply-chain and insider-risk concern when fraudulent hires gain access to corporate environments.