Microsoft warned Friday that North Korean operatives are increasingly using artificial intelligence tools to pose as Western job applicants and obtain remote technology positions, allowing them to funnel salaries and access to corporate systems back to Pyongyang.
According to the company, the operation relies on fabricated or stolen identities that are used to apply for software development and IT positions at companies in Western countries.
Microsoft said the individuals involved rely on AI-generated images to create professional headshots, develop believable Western-sounding names and email addresses, and customize job applications to match specific postings. During job interviews, the company reported that some applicants employ voice-modification technology to disguise their accents.
The company also said the operatives continue using artificial intelligence after being hired, relying on it to draft emails, translate documents, and produce code while attempting to avoid suspicion. One network of North Korean operatives tracked by Microsoft under the name Jasper Sleet, the company said, “leverages AI across the attack lifecycle to get hired, stay hired, and misuse access at scale.”
Officials say the scheme is significant because it has evolved from simple payroll fraud into a broader security concern for companies.
U.S. authorities have previously said North Korean remote IT worker operations depend on stolen or falsified identities, facilitators located in the United States, and so-called laptop farms that allow workers located overseas to appear as though they are operating computers inside the United States.
In June 2025, the Justice Department said the schemes had infiltrated more than 100 American companies. The FBI has also warned that in some cases the workers have taken sensitive corporate data or attempted to extort companies using the information.
Microsoft said it shut down roughly 3,000 Outlook and Hotmail accounts last year that were connected to fraudulent North Korean IT worker operations.
The company advised employers to take additional precautions during hiring, including conducting interviews via video or in person and watching for potential signs of manipulated images such as irregularities around faces, eyes, ears, or glasses.
Federal investigators have issued similar recommendations, urging companies to strengthen identity verification procedures, closely examine employment histories, and carefully review remote hiring practices.
Upwork, one of the online job platforms mentioned as a site where software and IT roles are often posted, said it actively works to identify and remove fraudulent users from its marketplace.
{Matzav.com}