A sprawling intelligence operation has come into sharper focus in 2026, with detailed analysis revealing that North Korean IT worker scammers flooded hundreds of thousands of U.S. companies with fraudulent job applications in 2024 and 2025. Using AI tools to generate convincing fake identities, conduct interviews, and sustain long-term employment without detection, these operatives secured positions at technology companies — often in sensitive roles involving access to proprietary code, customer data, and internal systems.

Threat intelligence firm Nisos brought this campaign to broader attention after investigating a suspicious applicant for a lead remote AI architect position. What began as a routine hiring concern unraveled into evidence of a systematic state-sponsored fraud operation operating at a scale that dwarfs previous known instances of North Korean corporate infiltration. The operatives appropriated real identities of U.S. citizens and immigrants, using AI-generated profile photos, fabricated employment histories, and coaching networks that helped them pass technical interviews.

Once hired, the operatives operated as normal employees — sometimes for years — while systematically exfiltrating valuable intellectual property, mapping internal systems, and in some cases introducing subtle vulnerabilities into software codebases that could later be exploited. The dual revenue model of the operation is notable: operatives earned legitimate salaries sent to North Korea while also stealing data and IP with significant resale or strategic value.

The emergence of AI tools has dramatically amplified this threat. AI can now generate photorealistic profile photos of non-existent people, create synthetic voices for video interviews, fabricate reference checks, and produce code samples of sufficient quality to pass technical screening. Human resources departments with no specific training in detecting AI-assisted identity fraud are largely defenseless against sophisticated implementations.

The U.S. House and Senate have responded to this and related threats by advancing versions of the fiscal year 2027 National Defense Authorization Act that tighten cybersecurity requirements for defense contractors while imposing new constraints on AI use in sensitive government contexts. Private sector organizations are being urged to implement enhanced identity verification for remote hires, particularly in technical roles with access to sensitive systems, including background check procedures that specifically test for synthetic identity indicators.