Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews and onboarding, creating an insider-risk pathway that can bypass traditional “hacking” defenses.
Investigators have found suspected North Korean operatives obtaining real jobs by impersonating other people, using stolen or forged identity documents and VPN or proxy services to hide their true location. This is not limited to IT roles anymore. Cases now include healthcare and sales and marketing positions, showing the fraud model is being applied more broadly across industries such as healthcare, financial services, software and technology, staffing and consulting, and government.
The workflow spans the entire employment lifecycle. It starts with fabricated or synthetic personas used to apply for jobs, continues through interviews where AI tools may be used to generate answers in real time, and persists after hiring through remote-access tooling and requests to bypass normal device and payroll policies.
This approach works because it targets human and process gaps rather than technical defenses. Traditional security controls are built around detecting intrusions, not around verifying that a new hire is who they claim to be. Interviewers are not typically trained to detect AI-assisted answers or synthetic personas, and onboarding teams may not scrutinize proof-of-residence documents or identity paperwork closely enough to catch small anomalies. Once someone is hired, they gain legitimate access, credentials, and trust, effectively bypassing the defenses organizations build against outside attackers.
Organizations can treat hiring and onboarding as a security control rather than purely an HR function. This means training interviewers and HR staff to spot AI-assisted interviewing and fabricated personas, performing rigorous identity and background verification before onboarding, and applying extra scrutiny when remote candidates present inconsistent signals. It also means enforcing standard processes for any changes to payroll details or work devices, since deviations from policy are a recurring pattern in these cases. Because this activity is described as an ongoing and scalable operation, continuous awareness and monitoring across HR, IT, and finance teams is more effective than a one-time check.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Beyond IT, the scheme has expanded into healthcare, financial services, software and technology, staffing and consulting, and government sectors.
They rely on stolen or forged identity documents and use VPNs and proxy services to mask their true identity and location during onboarding and employment.
Operators use screen recording software alongside AI transcription and chatbot tools to generate real-time answers during interviews, sometimes repeating chatbot responses verbatim.
Organizations should be cautious of requests to use personal devices or personal bank accounts for work and should enforce standard verification for any payroll or profile changes.
Imagine three “new hires” in healthcare… all real people on Zoom, all fake identities controlled from overseas. DPRK-linked workers are now getting hired into sales, marketing, even medical roles by impersonating other people with forged IDs, VPNs like Astrill, and proxies like IPRoyal, slipping past normal IT security as “remote staff.” Here’s the twist: during interviews they use AI, screen recording, live transcription, chatbot answers, to read out ChatGPT-style responses verbatim, backed by synthetically generated profile photos and polished fake resumes. If you spot duplicated IDs, weird bill wording, or interview answers that sound copy‑pasted, hit pause on hiring and escalate to Security, treat remote onboarding like a security incident, not just paperwork.
Huntress describes real investigations where suspected North Korean remote workers tricked companies into hiring them using stolen or doctored identity documents and tools to remotely control “employee” laptops. Cases span healthcare, financial services, and sales/marketing roles, showing a…
Research says a North Korea–linked operation (“PurpleDelta”) is using fake identities to apply for large volumes of remote IT jobs, sometimes successfully getting hired. Once inside a company, these “employees” can record meetings and steal sensitive information such as source code and internal…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
A University of Texas at Dallas student spotted a malicious pull request on GitHub and warned the project owner, only to be publicly challenged by what appeared to be other developers. UK officials later said those “people” were fake personas operated by an AI agent, which tried to discredit the…
