North Korean agents using AI to pose as western IT workers, Microsoft warns
TL;DR: North Korean state-backed groups are using AI voice changers, face-swapping tools, and AI-generated CVs to get hired as remote IT workers at western companies. Microsoft disrupted 3,000 accounts used in the scheme last year.
Microsoft’s threat intelligence unit has detailed how Pyongyang’s fake IT worker programme is being supercharged by AI tools. The operation, which has been running for years, involves state-backed fraudsters applying for remote tech jobs using stolen identities and in-country facilitators. Wages are funnelled back to the North Korean government.
How the scam works
Two groups tracked by Microsoft — codenamed Jasper Sleet and Coral Sleet — are using AI at every stage of the hiring process. Voice-changing software masks accents during remote interviews. The Face Swap app inserts North Korean faces into stolen identity documents and generates polished headshots for CVs.
AI also handles the initial job hunt. The groups use it to scan platforms like Upwork for software and IT roles, then tailor applications based on the skill requirements listed in job postings. Once hired, workers use AI to write emails, translate documents, and generate code to avoid being caught for poor performance.
Microsoft said example prompts include generating lists of culturally appropriate names and matching email formats to construct believable identities.
Scale of the operation
Microsoft disrupted 3,000 Outlook and Hotmail accounts used by fake North Korean IT workers last year. Some workers who were eventually fired threatened to release sensitive company data.
Looking forward
Microsoft recommends conducting job interviews on video or in person to spot deepfake tells — pixellation at the edges of faces, eyes, and glasses, or inconsistencies in how light interacts with AI-generated images. As the tools get better, those visual cues will become harder to detect, making verification processes more important than visual inspection alone.