A year-long investigation into the operation found that workers linked to North Korea have infiltrated American businesses by assuming the identities of US citizens, creating convincing professional profiles and using AI tools to help them pass recruitment checks. Thousands of suspected operatives are believed to be seeking positions across the country.
The scheme has expanded beyond simple identity fraud. Applicants use generative AI to prepare résumés, answer technical interview questions and produce culturally convincing names, email addresses and employment histories. Face-swapping technology and voice-altering software can also help workers conceal their identities during online interviews.
Some operatives have used AI after being hired to write emails, translate documents and generate computer code, helping them maintain the appearance of legitimate employees. The growing sophistication of these techniques has made conventional remote hiring checks less dependable and raised concerns about access to corporate networks and sensitive information.
Investigators have identified applications submitted to more than 1,000 companies during a three-month period by one network examined as part of the wider operation. Individual workers can earn salaries running into hundreds of thousands of dollars, with earnings ultimately routed towards organisations connected to North Korea.
US authorities have long warned that the employment schemes are designed partly to evade international sanctions and raise foreign currency for Pyongyang’s nuclear weapons and ballistic missile programmes. The operations also present an insider-security threat because successful applicants may gain access to source code, confidential documents, intellectual property and other sensitive corporate material.
The scale of the problem became clearer through enforcement actions against networks that provided infrastructure for overseas workers. Investigations have uncovered so-called laptop farms in which computers supplied by employers were kept at addresses inside the United States while workers abroad accessed the machines remotely.
A nationwide operation announced in June 2025 involved searches of 29 known or suspected laptop farms across 16 states, the seizure of about 200 computers, 29 financial accounts and 21 fraudulent websites. Court documents detailed schemes that placed overseas workers at more than 100 US companies using stolen or fabricated identities.
One network compromised the identities of more than 80 US residents between 2021 and October 2024 while securing positions at more than 100 companies, including Fortune 500 businesses. Victim companies incurred at least $3 million in legal expenses, network remediation costs and other losses.
The workers have also moved beyond salary generation. Authorities have linked suspected North Korean operatives to thefts of cryptocurrency, proprietary information and technology subject to US export controls. One overseas worker obtained access to technical information from a California defence contractor developing artificial intelligence-powered equipment.
Another operation involving workers who concealed their nationality while obtaining jobs at technology businesses resulted in the theft of virtual currency valued at more than $900,000. Authorities have warned that workers dismissed after being discovered have sometimes attempted to extort employers using confidential data obtained during their employment.
The international response has widened as the employment networks spread outside the United States. Eleven countries, including the United States, South Korea, Japan, Britain, Australia, Canada, France, Germany, Italy, the Netherlands and New Zealand, issued a joint warning on July 31 about North Korean IT workers operating under false identities.
The alert said the workers seek jobs and contracts through online employment and procurement platforms while directing earnings to North Korean organisations. It also warned that some workers have engaged in data theft, cryptocurrency theft and attempts to obtain sensitive information.
Pyongyang has rejected accusations surrounding its cyber and overseas technology activities, describing US-led warnings as politically motivated attempts to damage North Korea’s image. Its government has repeatedly challenged Western allegations about state-sponsored hacking and cybercrime.
Artificial intelligence is nevertheless altering the economics of the employment scheme. Tasks that previously required skilled document forgery, language proficiency and extensive preparation can now be performed more quickly. AI can generate tailored applications, assist with coding tests and help workers communicate convincingly with colleagues across different countries and time zones.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
