North Korean scammers are getting hired, then holding companies to ransom

North Korean scammers no longer need to break into a company's systems, they can simply apply for a job. A North Korean operative using a fake identity was hired as a remote IT contractor by a large New Zealand business, then threatened to release commercially sensitive information once exposed, New Zealand's National Cyber Security Centre (NCSC) disclosed in its Cyber Threat Report.

The worker used fake identity documents, a New Zealand address and a recruited New Zealand citizen to receive and operate the company laptop, according to the report. The business terminated the contract and refused to pay. The NCSC has since urged employers to interview remote staff face-to-face and require new hires to collect IT equipment in person.

The operative was not a lone fraudster. According to the NCSC, the North Korean state runs a coordinated program of remote IT workers to raise revenue for the regime, including for its sanctioned weapons programs, and these workers often operate under front companies overseen by the state apparatus.

Recorded Future reports their earnings are funnelled through facilitators, shell companies and money-laundering fronts to finance North Korea's military and nuclear programs.

For Ben Jones, practice lead, cyber security at Coder Trove, the case is a human resources story first and a cyber security story second.

"North Korea does not need to hack you. It just needs to get hired. This is not a phishing email you can train people to spot. It is a person who passes your interviews, writes decent code, submits their timesheets and gets paid. The fraud is the person," Jones said.

Candidate fraud at industrial scale

The New Zealand case is one thread of a far larger operation. Recorded Future's Insikt Group, which tracks North Korean IT workers under the name PurpleDelta, found that one cluster applied to jobs at more than 1,100 companies between late 2024 and early 2025, according to its August 2026 report.

Operators maintained at least 22 fabricated personas, some applied to at least 60 positions a day, and they were highly likely to be employed by at least 10 organisations at once.

Those personas were backed by AI-generated profile photos, custom-configured ChatGPT assistants and identity documents from an illicit ID-generation service, the report found.

The money is significant. US authorities estimate the scheme generated US$800m in 2024, while insider-risk firm DTEX puts the global take at approximately $864m a year.

In Australia, DTEX president and co-founder Mohan Koo told The Age that "dozens" of local firms were compromised, and Australian Security Intelligence Organisation (ASIO) Director-General Mike Burgess told 60 Minutes: "This is a very real concern."

Security firm Huntress separately found three staff at an Australian healthcare company were North Koreans impersonating Chinese nationals.

North Korea is not the only actor turning AI on employers. Jones said fraud gangs that once sent clumsy scam emails can now produce "word perfect emails" and translate them "into one of 50 languages" at the touch of a button – the same toolkit now being pointed at CVs and interviews.

How a fake remote hire works

Coder Trove mapped the tradecraft into 10 steps:

1. A fake person is built: a false identity, fake documents, an address and an AI-generated headshot.
2. A local helper is recruited: a real citizen agrees to be the face on the ground.
3. They apply for a remote IT contract: a perfect CV, a polished GitHub profile and a referee who cannot be traced to a real employer.
4. They pass the interview: questions are pasted into ChatGPT mid-call and answers read back word for word.
5. The laptop goes to the helper: it is shipped to a different address, then run remotely with remote desktop tools.
6. The real work happens offshore: to the business it looks like a normal local contractor, logged in every day.
7. They get paid and they get access: source code, customer data and cloud keys, with pay steered to a personal account.
8. The contract is terminated: the exit is handled like any other, and access is not pulled first.
9. Extortion follows: "Pay or the commercially sensitive data goes public."
10. It goes public.

By Coder Trove's count, five of those 10 steps run through HR – the CV, the interview, the identity check, the laptop and the pay run.

"Engineering managers assess whether someone can code. HR checks whether the paperwork lines up. Fraud teams look at payments. Nobody owns the question 'is this person who they say they are, every single day they are logged in?'" Jones said.

How can HR spot a fake candidate in the interview?

The interview is where operators are most exposed, because it is live and unscripted. Recorded Future found operators used real-time AI transcription to feed them answers, and Coder Trove says it now routinely sees remote engineering candidates reading AI-generated answers aloud.

The risk is rising as deepfake tools improve, with Gartner forecasting that one in four job candidates globally could be fake by 2028, a warning HRD examined in its coverage of a fake AI jobseeker exposed during a technical interview.

Jones said some employers are adding a second camera. "Lots of businesses are using two cameras now, or insisting on two cameras, so one from the back or the side and one on the front," he said. The aim is to catch candidates reading from a phone or a second screen.

Then there is the blunter test. Jones described a software company whose candidate passed every technical round, only to drop off the call when asked to insult the North Korean leader. A similar viral clip, reported by TechCrunch in April 2026, shows an interviewer asking an applicant to say "Kim Jong Un is a fat ugly pig".

The applicant appears to feign confusion, then leaves the call. Insulting the leader is illegal in North Korea, though TechCrunch noted the tactic is not foolproof for workers based in China or Russia.

Coder Trove's own stance is to assume the worst. "So we expect everyone that we interview, if they're from overseas, we just go into it fully expecting them to be a fraud," Jones said.

Why offboarding is the insider threat moment

Jones said HR's role does not end at hiring. Operators often reveal themselves through missed meetings, poor English or requests to change bank details, and the termination that follows is when the damage is done.

"Offboarding is when the attack usually starts," he said. In Coder Trove's 10 steps, the exit is handled like any other and access is not pulled first, leaving the data already taken as leverage for extortion.

There is legal exposure too. Australia's Department of Foreign Affairs and Trade (DFAT) has warned that continuing to pay a suspected North Korean worker "may be viewed as sanctions contraventions", Coder Trove noted.

In July 2026, Australia, New Zealand and nine other governments issued a joint statement warning that North Korean IT workers use increasingly sophisticated methods, including AI, to hide their identities, and the threat is certainly not confined to Asia-Pacific.

What HR leaders should do now

Drawing on Recorded Future's findings and the NCSC's advice, Coder Trove recommends that HR teams:

• Interview live and on camera, with real ID held up, and call former employers directly rather than the referee on the CV.
• Ship laptops only to the named hire, signed for in person, never to a different address or a "colleague".
• Match the bank account to the ID, refuse cryptocurrency and scrutinise any request to change payment details.
• Pull system access before, not after, a suspected fraudster is told they are terminated.
• Give HR a direct line to the security team.

"If your onboarding is a Zoom call and a PDF of a passport, you have already lost," Jones said. "You can patch a server. You cannot patch a person."

He is clear the answer is not to stop hiring offshore. "We are not saying stop hiring offshore. We hire offshore. We are saying the controls you put around a third-party library need to apply to a third-party human."