Security1 publisher2 min readPublished
Remote-worker fraud spreads beyond North Korea to Pakistan, India and Russia, Okta says
Okta's Katie Nickels says fake remote IT workers now operate from Pakistan, India and Russia as well as North Korea, mixing AI with human techniques. That moves the first security check on a new employee into the hiring process.
The Watch · Security desk
What happened
- Okta's experts said the main goal of these workers is money, paid either to the North Korean government or into the worker's own bank account.
- A US-based support network gives overseas workers American IP addresses and hires Western-looking stand-ins to sit their video interviews, according to Okta.
- Nickels said a simple scam clones a real person's LinkedIn profile, name included, and changes only the contact email so the candidate passes a cursory background check.
- AI is used to fake video interviews and to complete the job's tasks after hiring, letting some operators hold several remote IT jobs at the same time.
- Third-party recruiters often have quotas and skip due diligence, Nickels said, and many firms with overworked hiring teams rely on them.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Deepfake screening of interview video passes a stand-in who is a real, paid American; the check has to confirm that the person interviewed is the person who later logs in.
- constraint Shipping address stops working as a fraud signal once a US facilitation office is the delivery point for the company laptop.
- cost Employers pay salaries for output Immler says is largely fed through AI until the worker is caught, and one operator can draw several of those salaries at once.
- decision Security and HR teams have to decide whether a copied resume from a coder who does the job is an intrusion or a hiring dispute, since the same checks flag both.
Fake candidates can also be built from nothing. Scammers use AI to scrape LinkedIn for the skills and experience employers want, then assemble convincing profiles for people who do not exist [10]. "It just speaks to how easy it is to create synthetic fake IDs," said Jeremy Kirk, an Okta director of threat intelligence [11].
Laptop farms on US soil get past the equipment check: overseas workers remote-desktop into machines that make them look like they are in the US [13]. "If I think I'm hiring Jen from Minnesota but I also have to ship a laptop to Pakistan, that's a red flag right there," said Matt Immler, Okta's regional CSO. "But if there's a facilitation company that has an office in Minnesota somewhere, that's where it goes. ... They get a little cut of what the person in Pakistan or whatever country is making." [14]
North Korean operators are known for using AI to disguise their faces and voices. Nickels said the people sitting for interviews are often real Americans paid to take them [15].
The pattern Okta described at the Oktane conference last month, as SC World reported it, is a sustained trade with a division of labor [20]. Workers come from several countries [2]. US facilitators take a cut of their wages [14]. "We now use the term 'workforce infiltration,'" Nickels said. "The threat actors have really industrialized this at scale." [3] The scale claim rests on Okta's description [3]. SC World's account of the panel includes no case counts or victim figures [21].
Immler said espionage is still possible. "It's not like they won't take advantage to commit espionage if they target the right company and they happen to come across the right thing, but it's just not the primary motivator anymore," he said [5]. The workers are mostly outside the US and face little chance of punishment if caught [17]. "There's no downside to doing it," Immler said [8].
Kirk tied the problem to remote work. "It definitely is a phenomenon that really has occurred just through the way that work has changed," he said. "And the fact that people don't show up to offices every day like they used to." [16]
The degree of deception varies, SC World noted. Its example was an Indian coder who copies someone else's resume to improve his chances; he still does the job he was hired for, and the employer may be fine with that [18]. "It can be hard to hire really experienced software engineers," Kirk said. "There's a lot of competition." [19]
What to watch
- Case counts, victim figures or a country breakdown from Okta or others that would test the 'industrialized at scale' description.
- Enforcement against US laptop farms and facilitation offices, the part of the chain inside US jurisdiction while most workers sit abroad with little risk of punishment.
- A documented case of a worker from Pakistan, India or Russia using a job for espionage would cut against Okta's money-first account.