A suspected North Korean spy tried to get a remote job at a cybersecurity company by using a stolen identity, a fake AI-generated resume, and a VoIP phone number. The case shows that North Korea's state-sponsored IT worker program has become more advanced and harder to find without proper screening. Since the beginning of 2023, North Korean (DPRK) IT workers have been quietly getting into companies in the US and other countries by posing as qualified remote workers.

The North Korean government gets money from these operatives' paychecks, which helps pay for its weapons programs. If a company hires someone who is connected to this scheme, it could lose data, intellectual property, and face regulatory fines, as well as damage to its reputation.

This type of fraud has far-reaching effects that extend far beyond a single fraudulent job application. It targets businesses of all sizes, including those in the cybersecurity, intelligence, and technology industries. List of competencies for the position of Lead AI Architect (Source: Nisos) This demonstrates how much the two documents overlapped.

The job description's language was also used in the resume's summary section. He abruptly closed browser tabs and ended the call when asked to share his screen and walk interviewers through previous work. He stated that all of his earlier work was kept in private repositories that he was unable to share and that he lacked a GitHub portfolio. Across several platforms, three distinct resume accounts with the same name but different employers, universities, and locations were found.

The fact that one account was made as recently as May 2025 indicates that the persona was created especially for this particular job application campaign. Additionally, the employee gave a different mailing address for the laptop than what was on the resume. This verified that the device ended up in a closet with several other laptops provided by the company, all of which were connected via Tailscale mesh VPN service and remotely controlled via PiKVM devices.