DPRK Job Fraud Expands Beyond IT Into Healthcare, Sales and Marketing

🕵️ RESEARCH & DEEP DIVES

• DPRK Job Fraud Expands Beyond IT Into Healthcare, Sales and Marketing
  DPRK-linked actors are using fraudulent hires to enter healthcare, sales and marketing roles.
  • Australian healthcare, financial services, sales and marketing employers have been affected.
  • DPRK-linked workers used stolen or forged identities to obtain remote jobs beyond traditional IT roles.
  • Investigators found Astrill VPN, IPRoyal Proxy and fraudulent identity documents in an Australian healthcare case.
  • A financial-services laptop contained PiKVM and a Guermok USB capture card linked to remote laptop-farm access.
  • PurpleDelta used 22 fabricated personas, AI tools and TrustID Card documents while applying to more than 1,100 companies.
    📄 Source: huntress.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

🔓 CVEs & KEV

• CVE-2026-79748 — CVSS 9.9 — MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (miss...

• CVE-2026-79744 — CVSS 8.8 — MCPHub: Missing Authorization on PUT /api/system-config Lets Any Non-Admin ...

• CVE-2026-79746 — CVSS 8.1 — MCPHub: Server-scoped bearer key gains access to an entire group via partial ...

• CVE-2026-79750 — CVSS 7.7 — MCPHub authenticated horizontal IDOR: any non-admin user executes tools on ot...

• CVE-2026-79749 — CVSS 7.6 — MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL ValidationMCPH...

• CVE-2026-79745 — CVSS 7.1 — MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorize...

• CVE-2026-79747 — CVSS 7.1 — MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary...

• CVE-2026-79743 — CVSS 6.9 — MCPHub: Path Traversal via Malicious MCPB Manifest NameMCPHub is a unified hu...