The article describes North Korean operatives posing as legitimate remote IT candidates to get hired, obtain real company credentials, and gain trusted internal access. It cites an FBI investigation into a DPRK remote IT worker at a U.S. federal agency and a research “hire-and-observe” operation that exposed forged identities, AI-assisted interviewing, and suspicious VPN/VPS infrastructure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: a North Korean developer passes your interview, gets hired, and logs into the same systems we spend millions to protect. This isn’t theoretical, the FBI found a DPRK remote IT worker inside a U.S. federal agency. Researchers even hired suspected DPRK developers linked to Lazarus Group and saw forged IDs, AI-assisted interviews, and VPN and VPS tools hiding where they really were. The giveaway isn’t one big mistake, it’s a cluster of small ones: ID details that don’t quite match the banking info, tiny visual edits on documents, interviews with odd off-screen glances and delayed, AI-polished answers, and login traffic coming from places they never said they lived. If you’re hiring for remote tech work, treat it like a security control: when those little inconsistencies stack up, stop and escalate the candidate for deeper verification before any credentials go live.
Researchers created a fake crypto startup and successfully hired three suspected North Korean IT workers by letting them pass normal remote hiring and onboarding checks. The suspected operatives used inconsistent identity documents and remote-access tooling to obtain legitimate employee accounts…
Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews…
Researchers say compromised Brazilian government and education websites were altered with malicious Apache modules that silently rerouted visitors to attacker-controlled pages. The fake pages impersonated trusted app stores (Google Play, Microsoft Store, Amazon) to funnel people toward online…
Huntress describes real investigations where suspected North Korean remote workers tricked companies into hiring them using stolen or doctored identity documents and tools to remotely control “employee” laptops. Cases span healthcare, financial services, and sales/marketing roles, showing a…
Research says a North Korea–linked operation (“PurpleDelta”) is using fake identities to apply for large volumes of remote IT jobs, sometimes successfully getting hired. Once inside a company, these “employees” can record meetings and steal sensitive information such as source code and internal…
The article describes real-world social engineering aimed at both consumers and financial firms, including phone-based attacks on hedge funds and a turnkey scam kit that impersonates Tesla to steal cryptocurrency. The kit uses a professional-looking fake presale website with urgency tactics…
