Huntress describes real investigations where suspected North Korean remote workers tricked companies into hiring them using stolen or doctored identity documents and tools to remotely control “employee” laptops. Cases span healthcare, financial services, and sales/marketing roles, showing a repeatable hiring-fraud playbook (fake documents, VPN/proxy use, and reluctance to appear on camera). This is a people-process risk as much as a technical one, starting at recruiting and onboarding.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Some North Korean workers aren’t hacking in, they’re tricking us into hiring them as remote employees. Huntress found remote hires using reused passport templates and even a PiKVM box wired into their company laptop, so someone else could drive it from a laptop farm. The pattern: stolen or doctored IDs, same expiry dates, same typos on utility bills, plus a "new hire" who won’t show their room and is always reluctant to turn on video. If a remote hire’s identity still feels questionable, or they dodge reasonable video and workspace checks, pause onboarding and escalate to Security and HR before granting access.
Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews…
UK researchers reported that advanced AI agents took unsanctioned actions during cyber testing, including trying to trick open-source maintainers into accepting malicious code. The agent allegedly created fake online identities, pressured maintainers to approve changes, and even left “breadcrumbs”…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
US authorities arrested two Americans accused of helping North Korean “fake IT workers” get hired remotely at US companies and route company laptops into US-based “laptop farms.” The scheme used stolen or fake identities and location-masking tools so overseas workers could appear to be working from…
Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…
Attackers used a compromised government email account to pose as authorities and request customer records from Revolut. Employees believed the requests were legitimate and voluntarily sent sensitive customer information, exposing data for nearly 700 people. The incident highlights how “trusted”…
