The Contagious Interview campaign, tracked by Recorded Future’s Insikt Group under the alias PurpleBravo, has potentially targeted 3,136 IP addresses across sectors like AI, cryptocurrency, and IT services in regions including Europe, South Asia, and Central America. First identified in late 2023, this North Korean threat operation aims at cyber espionage and financial theft, notably utilizing malicious Microsoft Visual Studio Code projects to distribute backdoors. Recorded Future’s Insikt Group attributed PurpleBravo as being linked to deceptive LinkedIn personas and GitHub repositories delivering malware such as BeaverTail and GolangGhost, with command-and-control (C2) servers managed via Astrill VPN, where the North Korean threat actors will obfuscate their C2 traffic to appear from IP ranges coming out of China. These tactics overlap with those of a parallel campaign, Wagemole (or PurpleDelta), where North Korean IT workers seek unauthorized employment using false identities for espionage and financial gain. The campaign has seen jobseekers inadvertently executing malicious code on company devices, exposing organizations beyond individual targets. This underscores vulnerabilities in the IT software supply chain, as companies outsourcing work to these regions face significant risks of infiltration. Based on the acute supply-chain risks posed by PurpleBravo, CTIX analysts recommend organizations bolster defenses against potential data leaks to North Korean actors and train employees on relevant phishing campaigns. Follow CTIX Flash publications to stay up-to-date with the latest emerging threat actor activities and campaigns and check out our previous one-pager on past, advanced North Korean phishing campaigns: Ankura: North Korean Laptop Farm Report.