North Korean fake IT workers are submitting up to 60 applications a day, and experts urge in-person verification of contractors
North Korean fake IT workers are submitting as many as 60 job applications a day, ITPro reported from new research. Interviews are where these candidates succeed, so identity checks at hiring belong on the security team's list.
The Board Room · Leadership desk
Key figures: the PurpleDelta group created at least 22 fabricated personas; fake IT workers submit as many as 60 applications a day; around 80% of targeted companies were in North America, per Recorded Future.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Fabricated personas by PurpleDelta, at least | 22 personas | 4 | |
| Applications a day, up to | 60 applications | 3 | |
| Targeted companies in North America, around | 80% | per Recorded Future research | 6 |
What happened
- Recorded Future tracks one North Korean group as PurpleDelta, which built at least 22 fabricated personas and applied through sites such as LinkedIn and Upwork.
- Huntress documented workers linked to the Famous Chollima group getting hired in at least five cases this year.
- At KnowBe4 the hire tried to load malware onto a company-issued device before the business quickly shut it down.
- PurpleDelta uses identity-brokering services, AnyDesk account rental and multi-accounting tools to keep its applications going.
Why it matters
- exposure Sanctions liability falls on the employer even when the hire was unwitting, so legal shares ownership of this risk with security.
- constraint Identity brokering and rented accounts make remote-only proof of identity hard to trust. Fully remote contractor roles have the fewest checks left to use.
- decision Teams have to choose which contractor roles get an in-person check first, and who signs off when a role is exempted.
AI is a large part of why the interview no longer works as a filter. Jake Moore, global cybersecurity advisor at ESET, said: "AI chatbots can help them to draft emails, documents and interview talking points that sound impressive" [11]. In the pattern ITPro describes, the candidate answers every question correctly, appears legitimate and is onboarded onto company systems [2].
Effort and outcome are reported separately. The reporting does not say how many applications sit behind the hires Huntress counted, and the daily application ceiling is not tied to a named group. So neither figure gives an employer the odds that a given applicant is one of them. The figures do point in a direction, though: volume is high enough that a low success rate still yields placements.
Once the person is on the payroll, the exposure is wider than salary. Javvad Malik, lead CISO advisor at KnowBe4, said: "Once inside, these individuals may gain access to source code, customer data, intellectual property and wider corporate systems." [15] Alexander Leslie, senior advisor at Recorded Future, said the aim is an undetected foothold in Western businesses, particularly in software services, staffing and consulting, and healthcare and biotechnology [7]. Recorded Future found around 80% of targeted companies in North America [6], so roughly one in five sat elsewhere [14].
Tracey Hannan-Jones, consulting director in information security at UBDS Digital, set out the condition: according to her, any organization that hires IT contractors without conducting in-person verification is "potentially exposed" [9]. In-person verification slows remote hiring, and the hiring team pays for it up front. Skip it and the cost goes to security and legal later, at a time and size the employer does not control.
We'd expect a verification step added this quarter to need device monitoring beside it next quarter. An identity check settles who was hired. The account still has to be watched after onboarding.
The same actors also pose as recruiters targeting freelance IT workers. Security agencies put out a warning once that recruiter tactic was traced to North Korean-backed criminals working freelancers [12]. That group, WaterPlum, has infected at least 30,000 devices in more than 100 countries and stolen funds or account credentials from over 7,000 cryptocurrency wallets, around $10.7 million [13].
What to watch
- Whether any report ties the 60-a-day application figure to a named group or gives the number of applications behind Huntress's five hires.
- Whether enforcement actions appear against employers that hired a North Korean IT worker unknowingly, since the sanctions warning rests on one consultant's reading.
- Whether the roughly 80% North American share of targeted companies falls as applications spread to other markets.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption35
- Hype gap+15
- Incentives50
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In KnowBe4's case, the individual attempted to load malware onto their company-issued device before the business quickly shut it down.
- [2]
In the familiar North Korean fake IT worker scheme, a company runs remote interviews with a seemingly perfect candidate who answers every question correctly, appears legitimate, and is onboarded onto company systems.
- [3]
New research shows fake IT workers are submitting as many as 60 applications per day.
- [4]
Groups of North Korean IT workers, dubbed PurpleDelta by Recorded Future, created at least 22 fabricated personas, with job applications made across recruitment websites and platforms such as LinkedIn and Upwork.
- [5]
Workers linked to the Famous Chollima group have managed to get hired in at least five cases this year, according to security firm Huntress.
- [6]
Recorded Future's research found that around 80% of companies targeted by fake IT worker placements were in North America, with adversaries also applying to companies around the world.
- [7]
Alexander Leslie, senior advisor at Recorded Future, said the aim is to gain an undetected foothold in Western businesses, particularly in software services, staffing and consulting, and healthcare and biotechnology.
- [8]
Javvad Malik, lead CISO advisor at KnowBe4, said identity brokering, rented accounts and remote-access tools make it "difficult to distinguish a criminal from a genuine applicant".
- [9]
According to Tracey Hannan-Jones, consulting director in information security at UBDS Digital, any organization that hires IT contractors without conducting in-person verification is "potentially exposed".
- [10]
The PurpleDelta threat group is using identity-brokering services, account-renting via AnyDesk and multi-accounting tools.
- [11]
Jake Moore, global cybersecurity advisor at ESET, said AI has made fake IT worker schemes much easier to carry out at scale: "AI chatbots can help them to draft emails, documents and interview talking points that sound impressive".
- [12]
Security agencies issued an alert after North Korean-backed cyber criminals were found posing as recruiters to target freelance IT workers.
- [13]
WaterPlum, which targets software developers and IT professionals, has infected at least 30,000 devices in more than 100 countries and stolen funds or account credentials from over 7,000 cryptocurrency wallets, raking in around $10.7 million.
- [14]
Roughly one in five targeted companies were outside North America.
- [15]
Javvad Malik said the risk extends beyond payroll fraud: "Once inside, these individuals may gain access to source code, customer data, intellectual property and wider corporate systems."
- [16]
Hannan-Jones said an organization that unknowingly employs a North Korean IT worker is "almost certainly" violating international sanctions frameworks, and that penalties can be severe "even where the violation was entirely inadvertent".
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- itpro.comFake IT worker schemes are ramping up: How to manage the threat
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Sanctions ComplianceFollow
- North Korean IT worker schemesFollow
- Hiring fraud and identity verificationFollow