Microsoft says North Koreans use AI to fake remote IT jobs

In short: Microsoft says North Korean operatives are using AI to pose as Western IT workers and get remote jobs at US and European companies.

What's going on

Microsoft’s threat intelligence team says groups linked to North Korea, including names it tracks as Jasper Sleet and Coral Sleet, are using AI tools and chatbots to carry out job fraud. The goal is to get hired under fake identities and send earnings back to the North Korean state.

Microsoft says AI is used at almost every step. Operatives can ask a chatbot to generate believable Western names and profiles, like requesting “100 Greek-style names,” along with matching email addresses. They also create realistic profile photos by swapping faces onto stolen ID images or by generating new faces with AI (like a photo that never belonged to a real person).

During interviews, Microsoft says some use voice modification to hide accents. After they are hired, AI can help them keep the job by drafting emails, translating documents, writing software code, and scanning job ads for new roles. It is similar to having an always-on assistant that helps maintain a convincing work persona.

The US government estimates North Korea earns hundreds of millions of dollars per year from these schemes, according to the report. Microsoft also says it blocked about 3,000 Outlook and Hotmail accounts linked to this activity in 2025. Some workers have threatened to leak company data if they are fired, Microsoft says.

What to watch

Microsoft recommends video or in-person interviews and looking for signs of “deepfakes” (fake video or images), such as pixelation around a face, odd lighting, or strange reflections. Companies that hire remote IT workers may need tighter checks, because the same access used to do legitimate work could also be used to steal data or launch cyberattacks.

Source: Financial Times