Skip to content
Rising Threat from North Korean Fake IT Worker Schemes

Rising Threat from North Korean Fake IT Worker Schemes

First seen 14 Oct 2026, 14:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 17:35 UTC
  • •North Korean operatives are using deepfake technology to create convincing fake job candidates.
  • •The WaterPlum group has infected over 30,000 devices and stolen $10.7 million.
  • •Organizations worldwide are increasingly targeted, with a focus on sectors like software and healthcare.

North Korean operatives are increasingly using fake IT worker schemes to infiltrate companies, with reports indicating that they submit up to 60 job applications daily. These operatives create fabricated identities and utilize deepfake technology to appear credible during interviews. Recent incidents include attempts to deploy malware on company devices, with the group known as PurpleDelta creating at least 22 fake personas. Security agencies have issued alerts as these schemes expand beyond North America, affecting organizations globally. The WaterPlum group has reportedly infected over 30,000 devices and stolen approximately $10.7 million from cryptocurrency wallets. The evolving tactics make it challenging for organizations to distinguish between genuine applicants and criminals. Companies are advised to implement stringent hiring practices to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-01-01
FBI issues warning on North Korean job schemes
The FBI alerted companies about North Korean operatives using fake identities to apply for jobs.
Pindrop
2026-10-11
Pindrop investigates fake job candidates
Pindrop identified a candidate named 'Jamie' linked to North Korean operatives during their hiring process.
Pindrop
2026-10-14
ITPro reports on evolving fake worker schemes
ITPro highlights new tactics used by North Korean operatives in fake IT worker schemes, affecting global companies.
Itpro

More articles in this cluster (2)

Following this threat?

Track FAMOUS CHOLLIMA and Huntress in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

How can we identify fake candidates?
Look for inconsistencies in resumes, verify references, and use technology to detect deepfakes.
What sectors are most affected?
Sectors such as software services, staffing, consulting, and healthcare are particularly targeted.
What steps should we take to mitigate this threat?
Implement rigorous hiring practices, conduct thorough background checks, and train staff to recognize potential red flags.