cta-nk-2026-0121.pdf (4 MB)

Recorded Future’s Insikt Group links PurpleBravo to North Korea’s Contagious Interview activity targeting software developers, especially in software development and cryptocurrency-related roles. The campaign uses fraudulent LinkedIn personas, fake recruiter outreach, malicious GitHub repositories, interview tasks, and ClickFix-style prompts to deliver BeaverTail, PyLangGhost, and GolangGhost. Network intelligence tied 3,136 IP addresses and twenty potential victim organizations across AI, cryptocurrency, financial services, IT services, marketing, and software development to likely PurpleBravo targeting from August 2024 to September 2025. The activity creates software supply-chain risk because candidates may run malicious code on corporate devices, exposing employers and downstream customers, and the report also documents overlaps between PurpleBravo infrastructure and PurpleDelta North Korean IT worker activity.