Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews and onboarding, creating an insider-risk pathway that can bypass traditional “hacking” defenses.
Investigators have found suspected North Korean operatives obtaining real jobs by impersonating other people, using stolen or forged identity documents and VPN or proxy services to hide their true location. This is not limited to IT roles anymore. Cases now include healthcare and sales and marketing positions, showing the fraud model is being applied more broadly across industries such as healthcare, financial services, software and technology, staffing and consulting, and government.
The workflow spans the entire employment lifecycle. It starts with fabricated or synthetic personas used to apply for jobs, continues through interviews where AI tools may be used to generate answers in real time, and persists after hiring through remote-access tooling and requests to bypass normal device and payroll policies.
This approach works because it targets human and process gaps rather than technical defenses. Traditional security controls are built around detecting intrusions, not around verifying that a new hire is who they claim to be. Interviewers are not typically trained to detect AI-assisted answers or synthetic personas, and onboarding teams may not scrutinize proof-of-residence documents or identity paperwork closely enough to catch small anomalies. Once someone is hired, they gain legitimate access, credentials, and trust, effectively bypassing the defenses organizations build against outside attackers.
Organizations can treat hiring and onboarding as a security control rather than purely an HR function. This means training interviewers and HR staff to spot AI-assisted interviewing and fabricated personas, performing rigorous identity and background verification before onboarding, and applying extra scrutiny when remote candidates present inconsistent signals. It also means enforcing standard processes for any changes to payroll details or work devices, since deviations from policy are a recurring pattern in these cases. Because this activity is described as an ongoing and scalable operation, continuous awareness and monitoring across HR, IT, and finance teams is more effective than a one-time check.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Beyond IT, the scheme has expanded into healthcare, financial services, software and technology, staffing and consulting, and government sectors.
They rely on stolen or forged identity documents and use VPNs and proxy services to mask their true identity and location during onboarding and employment.
Operators use screen recording software alongside AI transcription and chatbot tools to generate real-time answers during interviews, sometimes repeating chatbot responses verbatim.
Organizations should be cautious of requests to use personal devices or personal bank accounts for work and should enforce standard verification for any payroll or profile changes.
Imagine three “new hires” in healthcare… all real people on Zoom, all fake identities controlled from overseas. DPRK-linked workers are now getting hired into sales, marketing, even medical roles by impersonating other people with forged IDs, VPNs like Astrill, and proxies like IPRoyal, slipping past normal IT security as “remote staff.” Here’s the twist: during interviews they use AI, screen recording, live transcription, chatbot answers, to read out ChatGPT-style responses verbatim, backed by synthetically generated profile photos and polished fake resumes. If you spot duplicated IDs, weird bill wording, or interview answers that sound copy‑pasted, hit pause on hiring and escalate to Security, treat remote onboarding like a security incident, not just paperwork.
Huntress describes real investigations where suspected North Korean remote workers tricked companies into hiring them using stolen or doctored identity documents and tools to remotely control “employee” laptops. Cases span healthcare, financial services, and sales/marketing roles, showing a…
Research says a North Korea–linked operation (“PurpleDelta”) is using fake identities to apply for large volumes of remote IT jobs, sometimes successfully getting hired. Once inside a company, these “employees” can record meetings and steal sensitive information such as source code and internal…
North Korean-linked actors are using fake identities to get hired into remote IT roles, then leveraging that trusted access to steal data or attempt to deploy malware. The article describes real cases (including KnowBe4 and Netskope) and explains how the scheme scales using fabricated personas,…
UK, US, and Dutch agencies warned that Iranian state-linked actors used social messaging apps to build trust with dissidents, journalists, and activists before sending disguised files that install Windows malware. The attackers often impersonated someone the target already knows or “technical…
Government agencies say Iranian intelligence-linked attackers are targeting dissidents, journalists, and activists with Windows malware controlled through Telegram. The attack starts with a trust-building message impersonating someone the victim knows or app support, then delivers a file disguised…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
