This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
North Korean IT workers are using AI-generated identities, enhanced profile photos, and AI-assisted communication to infiltrate Western companies, including Fortune 500 firms. These operatives use stolen identities to secure remote IT roles, allowing them to exfiltrate sensitive data, deploy malware, and extort employers to generate revenue for the North Korean government's weapons programs.
North Korean operatives have reportedly used AI-generated identities to secure remote jobs or impersonate employers in order to infiltrate companies. These tactics allegedly support sanctions evasion through wage theft, credential exfiltration, and malware deployment. Workers reportedly use fake resumes, VPNs, and face-altering tools; some deploy malware like OtterCookie after embedding, while others lure targets via spoofed job interviews. AI systems are reportedly used to generate fake resumes, alter profile photos, and assist in real-time responses during video interviews.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
Operatives compromised the personally identifiable information of dozens of U.S. citizens and exfiltrated proprietary corporate data to conduct extortion.
The incident involves North Korean operatives using AI-generated deepfakes and face-changing software to commit employment fraud and extort victim companies for financial gain.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was driven by human malicious actors intentionally using deployed AI tools to defraud and extort Western companies.
Added categories peak at 3: Substantial (Epistemic Harm, Inferred)
North Korean state-sponsored actors utilized AI-generated deepfakes and face-changing software to infiltrate over 300 Western companies, including government agencies and banks. By generating tens of millions of dollars to fund weapons programs and compromising proprietary data, this campaign represents a severe threat to economic and technological security.
The reports describe operatives using AI assistants to help answer interview questions in real-time and face-changing software to alter their appearance during video calls. These AI systems augment the human operatives' capabilities to deceive employers without taking independent action.
Risk Level 3: Limited Risk. The incident involves the use of AI-generated content, specifically deepfakes and face-changing software, to impersonate individuals during video calls and interviews.
The primary use of AI in this incident was to generate deepfake videos and alter facial features in real-time to deceive employers during video interviews and meetings.
The reports from the DOJ, Treasury, and major cybersecurity firms provide highly detailed, consistent, and corroborated accounts of the North Korean IT worker scheme, including specific indictment details, financial figures, and technical methodologies.
None. The evidence of coordinated state-sponsored employment fraud and extortion is overwhelming.
Technology
AI-Generated Executive Deepfakes
Used in fake Zoom meetings to deceive employees and build false trust.
Real-Time Face-Changing Software
Used during video interviews to bypass visual identity verification.
AI Assistants for Interviews
Helped fraudulent candidates answer technical questions in real-time.
Data Inputs
Stolen Personally Identifiable Info
Stolen PII of U.S. citizens used to create fake profiles.
AI-Altered Profile Images
Photos edited to create realistic but fake developer personas.
Fake Resumes and Portfolios
Resumes with fabricated experience and fake references submitted in volume.
Human Factors
Overreliance on Video Verification
HR assumed video calls were secure, failing to detect deepfakes.
Willingness of Domestic Facilitators
U.S. accomplices hosted laptop farms for financial gain.
Lack of Skepticism in Interviews
Interviewers missed signs of prompt-taking and long pauses.
Process and Methods
Inadequate Remote Vetting Methods
Hiring processes failed to thoroughly verify candidate identities.
Weak Remote Access Controls
Lack of detection for unauthorized remote desktop tools on corporate laptops.
No Ongoing Identity Verification
Companies failed to verify that the hired person was doing the work.
Management
Prioritizing Speed Over Vetting
Management focused on rapid hiring of contract workers over security.
Underestimating Insider Threats
Firms failed to assess risks of remote workers gaining privileged access.
Inadequate Detection Budgets
Lack of investment in insider threat detection and monitoring software.
Regulatory Environment
Sanctions Evasion Exploits
DPRK actors exploited gaps in freelance platforms to bypass sanctions.
Lack of Platform Identity Checks
Freelance and job search platforms lacked robust identity verification.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
