North Korean-linked actors are using fake identities to get hired into remote IT roles, then leveraging that trusted access to steal data or attempt to deploy malware. The article describes real cases (including KnowBe4 and Netskope) and explains how the scheme scales using fabricated personas, recruitment platforms, and increasingly convincing AI and deepfake tools.
Fake IT worker schemes start well before onboarding. Threat actors build fabricated personas with strong applications and legitimate-looking LinkedIn profiles, then apply broadly across recruitment platforms such as LinkedIn and Upwork. One documented group, dubbed PurpleDelta by Recorded Future, created at least 22 fabricated personas and used this scale to get into interview pipelines across multiple companies. Because the applications are strong and the profiles look real, many of these candidates make it through remote interviews and into onboarding.
The scheme exploits a gap between HR, security and IT. Remote-only identity verification makes it hard to catch inconsistencies that would be obvious in person. In one case, a candidate's application was strong and their LinkedIn profile legitimate, but small inconsistencies in their work history and a throwaway Outlook email address stood out on closer review. In another, a candidate answered every interview question correctly and appeared legitimate enough to be onboarded onto company systems, only for suspicious activity to follow soon after. AI tools are making this easier to scale, by helping draft convincing emails, documents and interview talking points, and more convincing, through real-time deepfakes and voice modulation.
Defenders and hiring teams should watch for:
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Threat actors build fabricated personas with strong applications and legitimate-looking LinkedIn profiles, then apply broadly across recruitment platforms like LinkedIn and Upwork to get into interview pipelines.
Signs include a throwaway Outlook email address, small inconsistencies in claimed work history, and an inability to give specific details about a claimed location beyond repeating the city name.
Once onboarded, they may gain access to source code, customer data, intellectual property and wider corporate systems, and in one documented case attempted to load malware onto a company-issued device.
The article notes that insisting on meeting the candidate in person, or asking a trusted third party to meet them if they are in another country, is considered the most effective verification method.
Imagine this: the ‘perfect’ remote IT hire passes every interview… and then tries to drop malware on their first day. Groups like PurpleDelta have built at least 22 fake personas, blasting out applications on LinkedIn and Upwork with strong résumés and legit-looking profiles, sometimes even using AI-written answers and deepfake video. Here’s the tell: the Netskope case looked great on paper, but the contact was a throwaway Outlook email, work dates didn’t quite line up, and basic questions about past jobs and location got awkward, vague answers. If a remote candidate feels too perfect but their story, email, or ID checks don’t fully add up, hit pause and escalate to security, hiring is a security decision, not just an HR task.
Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews…
Research says a North Korea–linked operation (“PurpleDelta”) is using fake identities to apply for large volumes of remote IT jobs, sometimes successfully getting hired. Once inside a company, these “employees” can record meetings and steal sensitive information such as source code and internal…
The article describes how “wrong-number” SMS messages are used as a first-step social engineering test to identify people who will engage with strangers. If the target replies, scammers may either build a long relationship that leads to fake investment fraud (“pig butchering”) or recycle the…
A CSC report describes real-world scams where criminals impersonate executives and brands online to steal personal or payment information. Examples include fake CEOs contacting people on LinkedIn with bogus job offers, and lookalike “FIFA” domains used for fake ticket sales, travel offers, and…
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
The Rust project warned of an active social engineering campaign targeting Rust team members and popular crate maintainers. Attackers pose as recruiters or contractors, lure developers into video calls, then trick them into installing software or running pasted code to steal credentials and publish…
