Case purpledelta-nk-it-worker-ai-personasState actor AI opsWorldwide
PurpleDelta North Korean IT workers use AI personas and custom ChatGPT assistants
Recorded Future describes PurpleDelta, a North Korean IT worker cluster, using AI-generated personas and custom ChatGPT assistants in fraudulent employment operations to infiltrate organizations.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 14, 2026
- Location
- Worldwide
- Target
- Organizations hiring remote IT staff
- Severity
- Medium
- Triggered by
- PurpleDelta (North Korean IT worker threat cluster)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Recorded Future describes PurpleDelta, a North Korean IT worker cluster, using AI-generated personas and custom ChatGPT assistants in fraudulent employment operations to infiltrate organizations.
Impact: Organizations infiltrated through fraudulent employment; the scale is not stated.
Who triggered it
Actor: PurpleDelta (North Korean IT worker threat cluster)
Attribution: Recorded Future identifies PurpleDelta as a North Korean IT worker threat cluster.
Motive: Unknown; infiltration of organizations through fraudulent employment.
How it happened
Attack vector: Fraudulent job applications using AI-generated personas and custom ChatGPT assistants.
Root cause: Hiring and identity verification processes can be fooled by AI-generated personas.
Timeline
- Reported by Recorded Future
Response
Recorded Future published indicators of compromise and mitigation guidance.
Current status: Ongoing
Sources (open in a new tab)
- Recorded Future recordedfuture.com
Cite this case
PurpleDelta North Korean IT workers use AI personas and custom ChatGPT assistants. AI Threat Watch, case purpledelta-nk-it-worker-ai-personas, Oct 14, 2026. https://aithreat.io/cases/purpledelta-nk-it-worker-ai-personas/
Permanent link: https://aithreat.io/cases/purpledelta-nk-it-worker-ai-personas/