North Korean operatives applied to 1,100 firms using AI-crafted fake identities

A North Korean state-directed operation used at least 22 fabricated personas to apply for remote positions at more than 1,100 companies, submitting as many as 60 job applications per day, according to a report published by Recorded Future Mastercard Incorporated ↘ 0.10% on August 17.recordedfuture

The threat intelligence firm designated the cluster PurpleDelta and said operatives were likely employed at 10 or more organizations, creating what it described as an ongoing insider threat.itpro

How the Scheme Worked

The fraudulent candidates used AI-generated profile photos, custom-configured ChatGPT assistants, and identity documents sourced from an illicit ID-generation service to apply across at least eight recruitment platforms, including LinkedIn Microsoft Corporation ↗ 0.56% and Upwork ↗ 2.36%. During video interviews, operators copied transcribed questions into ChatGPT and read answers back verbatim, according to Alexander Leslie, senior advisor at Recorded Future.securitybrief+1

Once hired, some workers recorded internal meetings and used screen-recording software during work sessions. Researchers found pre-written excuses, drafted with Google Translate, to justify the use of personal devices and bank accounts. In one case, a single operative managed at least four identities simultaneously.itpro+1

"Wages are often funnelled toward sanctioned North Korean military and nuclear programs, and access may also expose information that was never meant to leave a company," Leslie said.securitybrief+1

Rising Employment Scams Beyond State Actors

The findings arrive alongside broader warnings about remote hiring fraud. BBB North Alabama this week warned job seekers about a scam involving fake remote data entry positions tied to a purported Huntsville business whose listed address does not exist. The bureau said it received at least nine reports within 48 hours.waff+2

The Federal Trade Commission has reported that consumer losses from job and employment scams surged from $90 million in 2020 to $501 million in 2024. The BBB's 2026 Employment Scams Study found that complaints filed with its Scam Tracker doubled in 2025 alone.hoodline

What Companies Should Do

Recorded Future urged employers to verify worker identities after hiring and confirm the physical location of both personnel and hardware during onboarding. "PurpleDelta can recover quickly when one identity is exposed and a persona can be replaced," Leslie said. "The same application machinery can keep running under a new name".securitybrief+1