North Korean operatives are increasingly using artificial intelligence tools to fraudulently secure remote jobs at Western technology companies.
Microsoft says individuals associated with the North Korean government are applying for remote IT jobs using fabricated identities and AI-powered deception techniques.
We bring you stories from the field. Your support keeps our teams on the ground.
donate now
After gaining employment, the workers reportedly remit their earnings to the North Korean state while maintaining access to corporate systems.
The scheme typically requires applicants to submit their resumes for remote software development or IT roles under stolen or synthetic identities. Intermediaries, often based in the same country as the employer, help establish a local presence and facilitate the hiring process.
Artificial intelligence tools are used at several stages of operation. Voice modulation software is reportedly being used to hide accents during interviews and make applicants appear to be from Western countries.
read more
- category
- latest news
October 8, 2025 14:05
Image manipulation applications such as FaceSwap allow operators to insert faces into stolen identification documents and generate professional profile pictures for resumes.
The same tools are also used to build compelling digital identities at scale. Attackers generate lists of culturally appropriate names and corresponding email addresses and combine them with AI-assisted resumes and cover letters tailored to specific technology roles.
It also analyzes job listings on platforms like Upwork and other recruitment websites to extract the skills needed and adapt applications to individual jobs.
Microsoft reported that once workers are hired, they continue to use artificial intelligence tools to maintain the appearance of legitimate employment. AI systems can help compose emails, translate internal communications, and generate codes to help operators perform their daily tasks and avoid suspicion within the company.
read more
- category
- latest news
February 2, 2026 17:54
This activity is related to several North Korean cyber groups tracked by researchers as Jasper Sleet and Coral Sleet. The operation appears to combine financial objectives with long-term access to the corporate environment.
The company has previously disrupted infrastructure associated with the program, including thousands of email accounts used for recruiting and communicating with employers.
Microsoft noted that artificial intelligence is increasingly being integrated across multiple stages of cyber operations, such as reconnaissance, social engineering, and malware development. The same technology can accelerate phishing campaigns, aid vulnerability research, and help analyze stolen data after a breach.
Previously, newsweek North Korean leader Kim Jong Un has reportedly given his daughter Kim Jue, believed to be about 13 years old, a leadership role within the country’s Missile Control Bureau, which oversees North Korea’s nuclear arsenal, South Korean intelligence and government officials said.
-7f54d6f9a1e9b10de9b3e7ee663a18d9.png)
Our reporters are working on the front lines to tell you what’s really happening in Ukraine. Your support will help them keep reporting.
