North Korea’s scheme of placing fraudulent remote workers inside Western companies has expanded beyond software development into healthcare, biotechnology, and sales roles, according to new research from Huntress and Recorded Future. The operation, tracked as PurpleDelta by Recorded Future’s Insikt Group, applied for positions at more than 1,100 companies between late 2024 and early 2025 and has maintained 22 fabricated personas — some generated entirely by AI using identity documents sourced from an illicit service called TrustID Card. At its peak, PurpleDelta submitted over 60 job applications per day across ten platforms, managed through multi-account browsers and detailed tracking spreadsheets that coordinate identities across different companies.
During job interviews, the operators use real-time AI transcription tools and ChatGPT to generate answers on the fly, often repeating responses verbatim. Once hired, they install hardware like PiKVM (a remote-access device) and Guermok USB capture cards on company laptops sent to “laptop farm” facilitators, allowing them to work remotely while appearing local. In one Huntress-investigated case, a sales and marketing hire onboarded using a stolen identity had their profile photo swapped for a suspected DPRK operative’s face. The FBI is separately investigating a North Korean IT worker who successfully gained employment at an unnamed US federal government agency. Proceeds flow through a network of sanctioned front companies and are funneled to North Korea’s weapons programs and support for Russia’s war effort — an estimated $1.97 million flowed through sanctioned channels between December 2025 and February 2026 alone.