North Korea’s fake IT worker scheme takes dangerous turn as new threats emerge every day

North Korean operatives are using fake identities to obtain remote IT jobs at US companies, and cybersecurity researchers warn the scheme is increasingly being used to pursue intelligence. CrowdStrike says it is finding one or two suspected cases each day and has seen access handed to malware teams when a company is judged to hold valuable information.

Federal cases show the risks extend to defence and military technology. In one case, an overseas worker accessed a California defence contractor’s systems for more than two months and downloaded technical data, including material controlled under US arms regulations; in another, an impostor received a $130,000 job offer on a military generative AI project before being exposed during a video call. A separate laptop farm network allegedly helped workers obtain remote jobs at more than 100 US companies.