North Korean IT workers: how they get hired, and how to check

This is the hiring team's version of a security story. It sets out how big the scheme is, how it runs, what changed in 2025 and 2026, the signs at each hiring stage, and what the FBI and security researchers have told employers to do. Every fact links to its source below.

How big it is

100+

US companies where workers got remote jobs in one set of cases (US Justice Department, June 2025)

309

US businesses affected in one laptop-farm case (US Attorney's Office, July 2025)

~$800M

in revenue for the regime in 2024, by the US Treasury's count (March 2026)

In the June 2025 actions, the Justice Department said the workers had "compromised the identities of more than 80 U.S. persons", that agents carried out "searches of 29 known or suspected "laptop farms" across 16 states", and that one set of cases caused "damages and losses of at least $3 million". In the Arizona case, a US facilitator was sentenced to 102 months in prison; the release lists "68 U.S. person identities stolen" and "more than $17 million in illicit revenue". That figure is revenue for the scheme, not victims' losses.

Security researchers describe the same scale. Microsoft says "North Korea has deployed thousands of remote IT workers" and cites a US government finding of "over 300 US companies in multiple industries" affected from 2020 to 2022. CrowdStrike says it investigated 320 North Korean IT worker cases in a year, a 220% rise, by its own data. Amazon's security chief said the company had blocked 1,800 suspected North Korean applicants, as AFP reported in December 2025.

How the scheme works, step by step

Treasury says the workers "rely on fraudulent documentation, stolen identities, and fabricated personas". The FBI has described US facilitators taking part in "Attendance at virtual interviews and meetings on behalf of" the workers, and in October 2026 warned of Americans paid "to appear on camera, participate in job interviews or meetings". Once hired, the laptop goes to a US address, where facilitators keep it online, sometimes with "keyboard-video-mouse or "KVM" switches" so it can be used remotely.

The person who interviews is not always the person who works. The FBI warns that "the on-the-job work is completed by a different individual". Microsoft describes one worker who "has never been seen on camera during a video telecommunication session", and others using "voice-changing software".

What changed in 2025 and 2026

• AI in the interview. In January 2025 the FBI warned of workers "using artificial intelligence and face-swapping technology during video job interviews".
• Data extortion. The same advisory was titled "North Korean IT Workers Conducting Data Extortion".
• Europe. Google's threat team found one worker had "operated at least 12 personas across Europe and the United States" (April 2025).
• Cheap deepfakes. A Palo Alto Networks Unit 42 researcher "created a synthetic identity for job interviews in 70 minutes" as a test (April 2025). Okta found workers using AI to "Conduct mock job interviews via chat and webcam".
• More people on camera. In October 2026 the FBI described "thousands of state-controlled remote "IT Workers"" and more paid US facilitators, including people who appear on camera for them.

Signs hiring teams can check, by stage

ITWs cannot be identified reliably with a single indicator

No row on its own is a finding. The FBI's answer is "identity in depth": several checks, repeated, rather than one test at the start.

What employers were told to do

1. Do more in person. "Complete as much of the hiring and onboarding process as possible in person." (FBI)
2. Verify identity throughout. Use "identity-verification processes during interviewing, onboarding, and throughout the employment" (FBI).
3. Cameras on, from the first call. "Mandate video and request that their backgrounds be unobscured." (FBI). Unit 42 adds: turn cameras on "including initial consultations".
4. Use simple live checks. Ask the person to "wave their hand in front of their face" if the video looks odd (FBI).
5. Compare across calls. "Capture images for comparison with future meetings." (FBI). Mandiant suggests "periodic mandatory spot checks where remote employees are required to go on camera".
6. Control equipment. The FBI says to "only send to the address listed in the employee's identification documents", and to watch for unapproved remote-access tools.
7. Confirm history directly. Check "prior employment and higher education history directly" (FBI).
8. Stay alert. The Justice Department and FBI "ask all U.S. companies that employ remote workers to remain vigilant".

Why manual checks alone are hard

Each of these checks depends on someone remembering to do it, on every call. A stand-in can pass the interview and hand over the job. A Unit 42 researcher built a real-time deepfake in "just over an hour with no prior experience". And KnowBe4, a security company, hired one of these workers after "four video conference based interviews on separate occasions", by its own account.

Where Verified Call fits

Verified Call checks the person on the call, before it starts and while it runs, without joining. It checks for hidden AI answer tools, camera software, face swaps, deepfakes and AI avatars sent through camera software, and someone else answering. It checks that the voice on the call matches the person who did the check.

It works inside the video calls you already run. No bot in the participant list. It checks on the person's own computer, so it sees what a video call cannot carry: a tool hidden from screen sharing, or a face sent in through camera software. Each call is checked fresh. The host sees a plain result, with proof beside any flag, and a person can decline the check and still join with the host's link; the host sees that they declined.

We publish how we test, false alarms included. In our own testing, each of 4 hidden AI answer tools was found in 30 of 30 tries, with 0 of 30 false alarms with no AI tool open and 0 of 30 with everyday apps open (October 4, 2026). Camera software and direct cameras were read right in 20 of 20 live calls (October 2, 2026). Every condition is on the Research page.

Related checks are covered in proxy interviews, deepfake candidate detection and how to spot fake candidates.

Fair to candidates

These schemes are a state operation. They are not a reason to treat applicants with a particular accent, name or background differently, and doing so would wrong honest candidates. Check facts: identity, devices, and that the same person stays on the call. A flag is a reason for a calm follow-up question.

Focus on detecting fraud and misrepresentation, not stereotypes.

For industry numbers on stand-ins and false identities, see the interview integrity statistics.