Axios investigates

[phkrause]

North Korea's IT invasion

Illustration: Sarah Grillo/Axios

Nearly every Fortune 500 company is hiding the same scary secret: They've unwittingly hired a North Korean IT worker, Axios cybersecurity expert Sam Sabin reports. Why it matters: The undercover North Korean IT workers are often exceptional at their jobs — at least until they start stealing sensitive data or extorting companies that try to fire them. ?? The big picture: For North Korea, this is a precious revenue stream that evades American sanctions — capitalizing on the wealth of high-paying remote worker roles in the U.S. to route cash back to Pyongyang. For the companies targeted, the risks include reputational harm, IP theft, and even extortion. For Americans applying for scarce tech jobs, this is tough competition from the unlikeliest of places. ? How it works: North Korean IT workers lean on a web of AI-enabled tools, China-based front companies and U.S. accomplices to execute the scams. Workers use stolen U.S. identities to apply, tapping AI tools to create fake IDs, resumes and LinkedIn profiles. They use live face-swapping technology during video interviews to trick HR pros, or swap in colleagues fluent in English. Corporate laptops are shipped to Americans who are paid a fee to download remote access software and host the devices, which are controlled from thousands of miles away. Between the lines: Nine security officials who spoke with Axios all said they've yet to find a big company that hasn't fallen for the fraud. North Korea has invested years into building up its remote IT labor force, providing training for corporate espionage and IP theft. ? What to watch: "They're going to use AI to magnify exponentially what they're already doing," says Michael Barnhart, principal investigator at DTEX Systems.