Researchers created a fake crypto startup and successfully hired three suspected North Korean IT workers by letting them pass normal remote hiring and onboarding checks. The suspected operatives used inconsistent identity documents and remote-access tooling to obtain legitimate employee accounts and access to a work virtual machine. The case highlights how “authorized” access gained through hiring can become an insider-risk and espionage pathway.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you hire a remote dev, and on day one, you’ve basically onboarded North Korea. Researchers built a fake DeFi startup, Ballena Azul, and a recruiter trawling GitHub delivered a developer, who vouched for a friend, who vouched for a third. All three passed normal remote interviews and got real employee accounts and a work VM. Here’s the tell: one "hire" claimed Pasadena, Texas, but sent a California driver’s license and a New York bank account. The ID image metadata even showed Google Gemini and a SynthID watermark. On day one, another installed Chrome Remote Desktop and synced a personal Google account. If a remote hire’s location, ID state, and bank don’t line up, or they push to rush access, stop. Your move: pause the hire and escalate to security for a deeper identity check before any accounts go live.
An alleged North Korean operation called “WaterPlum” targeted job seekers by posing as AI and blockchain companies and using the interview process to trick applicants into downloading malicious files. Authorities say the campaign infected tens of thousands of devices worldwide and led to theft from…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
US authorities arrested two Americans accused of helping North Korean “fake IT workers” get hired remotely at US companies and route company laptops into US-based “laptop farms.” The scheme used stolen or fake identities and location-masking tools so overseas workers could appear to be working from…
A Singaporean man, Malone Lam (aliases including “Anne Hathaway”), pleaded guilty to leading a group that stole over $245 million in cryptocurrency from U.S. victims. The group used social engineering, such as posing as Google Support and using spoofed phone numbers, to trick victims into handing…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
