North Korean IT workers pay Americans to appear on camera and keep work laptops online
FBI says North Korean IT workers increasingly depend on witting and unwitting Americans to win jobs at U.S. companies. The bureau says no single indicator catches them, so employers have to weigh several signals together.
The Watch · Security desk
FBI: Americans who take part: illegal, risking law enforcement scrutiny. Americans in illicit schemes: threats of violence to compel them. Americans in financial stress: strategically targeted. Job board users: fake gigs. Employers: no single indicator reliably identifies ITWs.
- exposure Americans who take part FBI says the paid tasks are illegal and put participants at risk of law enforcement scrutiny, claim 6
- exposure Americans in illicit schemes ITWs have used threats of violence and intimidation to try to compel them to continue, claim 15
- exposure Americans in financial stress North Korean ITWs strategically target them for help acquiring U.S. jobs, claim 4
- exposure Job board users Fake openings, often freelance gigs, ask them to interview for someone or host laptops at home, claim 13
- constraint Employers FBI says no single indicator reliably identifies ITWs, given overlap with legitimate remote work, claim 7
| Who | How | Kind | Claim |
|---|---|---|---|
| Americans who take part | FBI says the paid tasks are illegal and put participants at risk of law enforcement scrutiny | exposure | 6 |
| Americans in illicit schemes | ITWs have used threats of violence and intimidation to try to compel them to continue | exposure | 15 |
| Americans in financial stress | North Korean ITWs strategically target them for help acquiring U.S. jobs | exposure | 4 |
| Job board users | Fake openings, often freelance gigs, ask them to interview for someone or host laptops at home | exposure | 13 |
| Employers | FBI says no single indicator reliably identifies ITWs, given overlap with legitimate remote work | constraint | 7 |
What happened
- The FBI lists paid tasks that include appearing on camera, joining interviews, verifying fraudulent identities, giving urinalysis or fingerprints, and hosting devices at home.
- The bureau has also seen North Korean workers use stolen identities, extort victims and threaten physical violence to demand payments.
- Recruitment runs through fake openings on well-known job boards, often freelance gigs that ask someone to interview on another person's behalf or host a laptop.
- The FBI says these actions are illegal and expose the Americans who take part to law enforcement scrutiny.
Why it matters
- exposure A paid stand-in can pass the interview, identity check, urinalysis and fingerprint steps, so a clean onboarding record is weak evidence of who later logs in.
- decision Because most named signals sit on the endpoint, security teams have to decide how remote-desktop tools and KVM hardware feed hiring and contractor reviews run by HR or procurement.
- precedent The FBI presents facilitators as a reaction to better detection and describes its layered model as working regardless of the next tactical change.
The FBI gives a cause for the change. It says the workers are using facilitators to counter improved private sector detection and law enforcement action [2]. The bureau describes thousands of state-controlled remote workers who are trying to infiltrate western companies while avoiding detection [1], and says their earnings fund North Korea's government, including its nuclear weapons and other military programs [16].
The FBI's remedy is what it calls "identity in depth": multiple layered access controls and detections across the employment lifecycle [8]. It says one detection is not enough because worker activity is diverse and overlaps significantly with legitimate remote employment [7]. Behaviors that look innocuous alone are, in its words, highly suggestive when considered together [9].
The list of behaviors is concrete. Workers connect to employment devices with remote desktop software, including AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer and remote monitoring and management tools [10]. They use KVM-over-IP hardware such as TinyPilot, PiKVM and GL.iNet, and sometimes separate laptops that remote into the employer-provided one [11]. They download applications unrelated to the job and abuse open-source software such as OBS Studio with VDO.Ninja [12]. The advisory text we reviewed breaks off in the middle of that list.
Almost all of those signals appear on the endpoint, not in an applicant file.
On the facilitator side, the FBI says workers strategically target Americans under financial stress [4]. It lists the backstories used to lend credibility, including claiming to be Chinese or East Asian nationals who need a temporary U.S. presence, or Eastern Europeans displaced by the Russia-Ukraine war [14]. It also says workers have used threats of violence and other intimidation to try to compel Americans to continue [15].
The facilitators in this account are outside individuals who appear on camera, hold accounts and host devices for the worker [5]. The PSA does not say existing employees at victim companies are being recruited, and it does not include a count of facilitators.
What to watch
- Any FBI or DOJ case that places a facilitator on a victim company's own staff, which would move this from outside helpers to recruited insiders.
- Whether later FBI updates keep naming products such as TinyPilot and PiKVM or describe behaviors only.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap
- Insufficient
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
North Korea continues to improve its tactics to infiltrate western companies with thousands of state-controlled remote IT workers (ITWs) while avoiding detection.
- [2]
ITWs are increasingly using facilitators to counter improved private sector detections and law enforcement actions.
- [3]
The FBI has observed North Korean ITWs use stolen identities, extort victims, and use threats of physical violence to demand payments.
- [4]
North Korean ITWs increasingly rely on the help of witting and unwitting Americans to acquire jobs in the United States, and they strategically target those under financial stress.
- [5]
ITWs pay Americans for an expanding range of services to hide their own involvement, including asking some to appear on camera, participate in job interviews or meetings, verify fraudulent identities, provide access to personal social media or professional networking accounts, ship packages, complete urinalysis tests or fingerprint submissions, or keep employment-related devices connected to the Internet from personal residences.
- [6]
The FBI says these actions are illegal, and participating in them puts individuals at risk of law enforcement scrutiny.
- [7]
The FBI notes North Korean ITWs cannot be identified reliably with a single indicator or detection given the diversity of their activity and significant signature overlaps with legitimate remote employment.
- [8]
The FBI says detection requires an 'identity in depth' approach: multiple layered access controls and detections throughout the employment lifecycle to find, interdict, and remove ITWs regardless of North Korean tactical innovations.
- [9]
Finding ITWs in applicant pipelines or on corporate networks requires examining multiple compounding behaviors that may be innocuous individually but, considered together, are highly suggestive of malicious activity.
- [10]
ITWs continue to use remote desktop software to connect to employment-related devices, including AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop Streamer, and remote monitoring and management (RMM) software.
- [11]
ITWs use external KVM over IP hardware such as TinyPilot, PiKVM, GL.iNet and similar devices to control laptops, and have also purchased and used separate laptops to remote into and control employer-provided devices.
- [12]
ITWs frequently download applications outside of, or unconnected to, their job role on work devices, and abuse open-source software such as OBS Studio with VDO.Ninja (the source text is cut off at this point).
- [13]
North Korean ITWs post fake job openings on well-known job boards, often as freelance gigs with simple requests such as interviewing on someone's behalf or receiving and hosting laptops in your home.
- [14]
ITWs invent elaborate stories, create fake companies and produce official documentation; common backstories include claiming to be Chinese or East Asian nationals in need of a temporary U.S. presence, or Eastern Europeans displaced by the Russia-Ukraine war.
- [15]
ITWs have used threats of violence and other acts of intimidation to try to compel Americans to continue illicit activities.
- [16]
ITWs fund North Korea's government, including its nuclear weapons and other military programs, and pose a significant national security and intellectual property theft insider threat.
Sources
1 independent publisher whose own reporting we read for this story.
- Internet Crime Complaint Center (IC3) | North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
ic3.gov
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Identity VerificationFollow
- Insider ThreatFollow
- North Korean IT worker schemesFollow