PurpleDelta, a North Korean threat actor group, executed a fraudulent employment campaign by creating numerous AI-generated fake personas supported by fabricated documents and custom ChatGPT assistants. They applied to thousands of positions across multiple sectors using advanced tradecraft including multi-account management and real-time AI-assisted interview responses. Once employed at multiple companies, they conducted insider threat activities such as recording internal meetings and coordinating with facilitators using company hardware and encrypted communications. This campaign exploits remote work environments and AI technologies to establish persistent insider access across numerous organizations.

The campaign enables PurpleDelta operators to gain insider access to multiple organizations simultaneously, potentially exposing sensitive internal information through recorded meetings and other insider activities. The use of personal devices and bank accounts for operational coordination increases the risk of data exfiltration and operational security breaches. This ongoing insider threat compromises organizational security, particularly in sectors targeted for their sensitive intellectual property and operational data.

No official patch or fix applies as this is a human-driven insider threat campaign. Organizations should enhance their employee verification processes to detect AI-generated personas and fraudulent documents. Monitoring for unusual multi-account applications, implementing robust identity verification, and conducting thorough background checks are recommended. Additionally, organizations should enforce strict controls on recording devices and monitor for unauthorized use of personal devices and communication platforms within corporate environments. Awareness of this specific threat actor's tactics can guide targeted insider threat detection and response efforts.