North Korean hacking group PurpleBravo has launched a cyber espionage campaign targeting over 3,100 IP addresses linked to AI, cryptocurrency, and finance companies, according to a study by Recorded Future. The group used fake job interviews to infiltrate organizations, posing as recruiters or developers to trick targets into executing malicious code. Victims span 20 organizations across South Asia, North America, and other regions. The attackers employed remote access trojans like PylangGhost and GolangGhost to steal browser credentials and cookies. They disguised their operations using a fake Odessa, Ukraine identity and hosted malware through a GitHub repository and various service providers. The investigation also uncovered related Telegram channels selling LinkedIn and Upwork accounts, with interactions noted with the cryptocurrency exchange MEXC Exchange.