PurpleDelta, a North Korean threat actor group, executed a fraudulent employment campaign by creating numerous AI-generated fake personas supported by fabricated documents and custom ChatGPT assistants. They applied to thousands of positions across multiple sectors using advanced tradecraft including multi-account management and real-time AI-assisted interview responses. Once employed at multiple companies, they conducted insider threat activities such as recording internal meetings and coordinating with facilitators using company hardware and encrypted communications. This campaign exploits remote work environments and AI technologies to establish persistent insider access across numerous organizations.

This campaign enables PurpleDelta operators to gain insider access to multiple organizations simultaneously, potentially exposing sensitive internal information through recorded meetings and other insider activities. The use of personal devices and bank accounts for operational coordination increases the risk of data exfiltration and operational security breaches. This ongoing insider threat compromises organizational security, particularly in sectors targeted for their sensitive intellectual property and operational data.

No official patch or fix applies as this is a human-driven insider threat campaign. Organizations should enhance employee verification processes to detect AI-generated personas and fraudulent documents. Recommended measures include monitoring for unusual multi-account applications, implementing robust identity verification, and conducting thorough background checks. Additionally, enforcing strict controls on recording devices and monitoring unauthorized use of personal devices and communication platforms within corporate environments is advised. Awareness of this specific threat actor's tactics can guide targeted insider threat detection and response efforts.