North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales
Summary: North Korean threat actors tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole have been found seeking remote jobs outside IT, including in sales and marketing and the medical profession, using stolen or forged identity documents, VPNs, and proxy services to mask their identities. Recorded Future observed one PurpleDelta-linked cluster apply to jobs at over 1,100 companies between late 2024 and early 2025, maintaining 22 fabricated personas and applying to at least 60 positions per day across 10 job platforms.
Why it matters: These workers often do the legitimate job they were hired for, so no account compromise or malware signals the breach - and employing or paying them could breach U.N., U.S., and U.K. financial sanctions, a legal exposure that lands on the organization that hired them.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026