US authorities say North Korean operatives used stolen and fake identities to get hired into remote roles at more than 70 US companies, then operated company laptops from inside the US using “laptop farms.” Americans allegedly helped by receiving employer-issued laptops, keeping them online, and enabling remote access, sending millions in wages back to North Korea.
According to US authorities, North Korean IT workers used stolen and fabricated identities to get hired into remote roles at more than 70 US companies. Once hired, the operatives relied on US-based helpers to receive employer-issued laptops and keep them running from residential locations, often called laptop farms. These helpers installed remote-access software so the real operator, based overseas, could log in and work as if present in the United States, defeating geolocation-based fraud controls and identity verification systems built for legitimate employment.
The scheme combined several layers of deception that each targeted a different stage of the hiring pipeline. Stolen and fabricated identities bypassed initial screening. Paid US-based stand-ins appeared on camera during interviews to pass visual identity checks, and some individuals lent social media or professional networking accounts to add credibility. The FBI noted operatives strategically target people under financial stress, who may be more willing to accept payment for seemingly low-effort tasks like receiving packages or logging into accounts.
Organizations hiring for remote roles should treat onboarding as a security control, not just an HR process. Strengthening identity verification, watching for stand-ins during video interviews, and flagging unusual shipping or device patterns can help catch this activity early. Employees and contractors should also be trained that offers to help with verification, including appearing on camera for someone else, lending accounts, or shipping packages on another person's behalf, are illegal and risky; the FBI has warned that participants face law enforcement scrutiny. Finally, managers and security teams should be prepared for retaliation or extortion attempts after termination, including threats to leak corporate data, and should route any such incidents through legal, HR, and security channels rather than engaging directly with the threat actor.
This case illustrates how identity-based social engineering can extend well beyond phishing emails into the hiring process itself, requiring coordination between recruiting, HR, IT onboarding, and security teams to close the gaps attackers are exploiting.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a US-based location where Americans keep employer-issued laptops running and enable remote access so overseas operatives can work as if they were physically in the US.
Prosecutors allege operatives paid Americans to appear on camera during job interviews, verify fake identities, or lend social media and professional networking accounts.
Watch for shipping addresses that don't match a candidate's claimed location, inconsistent or unverifiable applicant details, and multiple company laptops later appearing at a single residential address.
According to the FBI, participants who received devices, ran remote-access software, or appeared on camera for operatives were allegedly paid, but the bureau warned these actions are illegal and put participants at risk of law enforcement scrutiny.
North Korean IT workers have already slipped into 70-plus US companies by faking remote hires. Here’s the trick: they steal or fabricate an identity, get hired remotely, then have the laptop shipped to a US helper’s home, a “laptop farm” that keeps your company device online for someone overseas. They even pay Americans under financial stress to appear on camera for interviews, verify fake IDs, or lend LinkedIn-style accounts, so the person you see isn’t the one using the laptop. Aha moment: that odd shipping address or stand-in on video is a security alarm. If an applicant’s identity or laptop destination feels off, pause hiring and report it to Security immediately.
U.S. authorities charged 14 people tied to a North Korea-backed scheme that used stolen or fake identities to get remote IT jobs at more than 70 U.S. companies and funnel about $3 million back to Pyongyang. The operation relied on “laptop farms” in the U.S. to keep employer-issued laptops online…
US authorities arrested two Americans accused of helping North Korean “fake IT workers” get hired remotely at US companies and route company laptops into US-based “laptop farms.” The scheme used stolen or fake identities and location-masking tools so overseas workers could appear to be working from…
Two US Air Force members ran phishing campaigns to steal employee email credentials, then used spoofed emails to impersonate victims or their business partners. They redirected legitimate wire payments, including transfers of $1.68M and $720K, into accounts controlled by the conspiracy, and also…
An alleged North Korean operation called “WaterPlum” targeted job seekers by posing as AI and blockchain companies and using the interview process to trick applicants into downloading malicious files. Authorities say the campaign infected tens of thousands of devices worldwide and led to theft from…
Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews…
The FBI and NCAA warned that criminals are breaking into college athletes’ online accounts to steal intimate photos and then use them for sextortion, harassment, or selling online. The article describes common entry methods like fake “customer support” password-reset requests and credential abuse,…
