FBI WARNS NORTH KOREAN IT WORKERS ARE EXPANDING FAKE EMPLOYMENT SCHEMES, RECRUITING AMERICANS, AND THREATENING VICTIMS WITH VIOLENCE

WASHINGTON, D.C. — The Federal Bureau of Investigation has issued an updated cybersecurity warning concerning North Korean government-directed information technology workers who are infiltrating American and other Western companies through fraudulent employment arrangements, stolen identities, and expanding networks of paid facilitators. The FBI reports that these operations are being used to generate revenue for North Korea’s government, including programs associated with nuclear weapons and military development, while exposing employers to intellectual property theft, extortion, and insider security threats.

The October 13, 2026, Public Service Announcement, identified as I-101326-PSA, describes a growing effort by North Korean IT workers to evade corporate identity verification systems and law enforcement investigations. According to the FBI, thousands of state-controlled remote workers are involved in schemes designed to obtain employment with companies that believe they are hiring legitimate applicants.

The Bureau estimates that North Korean authorities receive approximately 85% to 90% of the revenue generated by these workers. The operations therefore represent more than employment fraud, functioning as a revenue-generating mechanism for North Korean government entities while providing opportunities to access sensitive corporate information.

A major development involves the recruitment of American citizens to assist with fraudulent employment arrangements. The FBI warns that North Korean operatives are targeting individuals experiencing financial hardship, offering payments in exchange for activities that conceal the actual identities and locations of the workers.

These arrangements can involve Americans participating in job interviews, appearing on camera during meetings, providing personal identification, allowing access to professional networking accounts, receiving company-issued computers, or maintaining equipment connected to the internet from residential addresses.

Investigators have also observed requests for facilitators to complete employment-related identity verification procedures, including fingerprint submissions and drug screening tests. Such activities can allow a fraudulent applicant to satisfy employer requirements while concealing the identity of the individual who will actually perform the work.

The FBI cautions that participation in these schemes can expose facilitators to criminal investigation, even when an individual initially believes the arrangement represents an ordinary freelance opportunity.

North Korean operatives have used fabricated employment advertisements on legitimate job platforms to recruit participants. Some advertisements offer payment for relatively simple tasks, including attending interviews on another person’s behalf or hosting employer-issued laptops.

To support these requests, the workers may present elaborate explanations, fabricated business documentation, or false personal histories. The Bureau has observed operatives claiming to be foreign professionals needing temporary assistance establishing a United States presence, including individuals posing as Chinese or other East Asian nationals or Eastern Europeans displaced by the Russia-Ukraine war.

These fabricated identities are intended to provide plausible explanations for unusual employment arrangements without revealing the involvement of North Korean government-directed workers.

One established technique involves operating laptop farms, in which employer-issued computers are maintained at American residential addresses while workers access them remotely from other locations.

The arrangement can make corporate systems register activity originating from a domestic internet connection, obscuring the worker’s actual location. The FBI reports that operatives have begun distributing their equipment among a greater number of smaller laptop farms, reducing the consequences of individual locations being discovered or disrupted.

Investigators have identified the use of legitimate remote administration products, including AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, and Splashtop Streamer, along with remote monitoring and management software.

External keyboard, video, and mouse devices capable of remote operation are also being used. Equipment identified in the advisory includes TinyPilot, PiKVM, and GL.iNet products, which can support remote interaction with computers through network connections.

These technologies have legitimate business and technical applications. Their presence alone does not establish malicious activity, and the FBI emphasizes that companies should evaluate multiple indicators before determining that an employee or contractor is involved in fraudulent employment.

The Bureau has also observed misuse of open-source applications, including OBS Studio with VDO.Ninja and Homebrew, in connection with unauthorized remote access and software management. Investigators report that North Korean workers commonly record their screens to document daily activity, creating additional opportunities for company information to leave employer-controlled environments.

The threat has expanded beyond direct employment fraud. North Korean operatives are subcontracting work to freelancers in countries including Pakistan, India, and Nigeria, sometimes paying individuals to complete assignments for a fraction of the salary received from the employer.

Some facilitators are hired to submit large volumes of applications or conduct interviews, allowing North Korean workers to pursue numerous positions without appearing directly in the recruitment process.

The FBI also reports widespread misuse of stolen personally identifiable information. Operatives use other people’s names, addresses, and professional profiles when applying for employment, sometimes purchasing identity verification services to determine whether stolen information can pass background checks.

Legitimate professional networking accounts are particularly valuable because established employment histories and years of activity can make a fraudulent application appear credible. The Bureau has identified cases involving unauthorized use of these accounts and situations in which facilitators’ identities were used for more job applications than originally agreed upon.

The investigation has also revealed a more aggressive element of the operations. North Korean IT workers have used threats of physical violence, including death threats against former managers and their families, to demand payments after employment relationships were terminated.

Other incidents have involved threats to publish stolen corporate records, disclose proprietary information, or damage a company’s reputation unless substantial payments were made.

The FBI has observed cases in which paid facilitators appeared in person at company locations or residences associated with laptop farms to intimidate individuals. These developments extend the threat beyond financial fraud and unauthorized system access into physical intimidation and coercion.

Federal authorities are also concerned about attempts to obtain positions involving sensitive government contracts and national security information. The advisory identifies North Korean workers seeking employment with cleared defense contractors and organizations supporting United States government operations.

Operatives have sought identities and facilitators possessing specialized technical qualifications or security clearances. The FBI also reports that active-duty military personnel have been targeted for recruitment as laptop hosts.

Access to such environments could place sensitive information, intellectual property, and government-related systems at risk. The FBI characterizes the activity as a significant insider threat because fraudulent workers may receive authorized system access after successfully deceiving an employer during hiring.

To counter these operations, the FBI recommends an “identity in depth” security approach combining multiple verification methods, access controls, behavioral monitoring, and continuing employee identity assessments.

The Bureau warns against relying on a single indicator, including an applicant’s name, nationality, apparent geographic location, or use of remote access software. Such methods can generate false positives, unfairly exclude legitimate applicants, and create additional problems for victims whose identities have been stolen.

Instead, employers are encouraged to examine patterns involving unusual account changes, inconsistent identity information, unexpected remote connections, unauthorized software installation, repeated replacement of banking details, and unexplained differences between hiring records and actual work activity.

Effective detection also requires cooperation among human resources, information technology, cybersecurity, and management personnel. Each department may encounter information that appears ordinary in isolation but becomes significant when evaluated alongside other unusual activity.

The FBI emphasizes that identity verification should continue throughout employment rather than ending once a candidate has passed an initial screening. Organizations must also balance stronger controls against the risk of disrupting legitimate remote workers.

For individuals approached with suspicious employment offers, the FBI recommends refusing requests to provide personal account credentials, identification documents, financial information, or access to residential internet connections in exchange for payments connected to another person’s employment.

Anyone receiving credible threats of physical violence should contact emergency services immediately.

Businesses and individuals who encounter suspected North Korean IT worker activity are encouraged to notify their local FBI field office and submit a complaint through the FBI’s Internet Crime Complaint Center (IC3). Reports should include relevant account information, communications, known addresses, financial identifiers, device-related evidence, and other details that could assist investigators.

The October 13 warning identifies an evolving national security threat in which fraudulent employment, identity theft, remote system access, and coercion are being combined to generate revenue for North Korea while compromising American businesses. The FBI’s updated guidance calls for stronger identity verification throughout the employment process and coordinated efforts to identify these operations before they result in financial losses, stolen information, or threats against employees.

---

---

Federal Bureau of Investigation (FBI), Internet Crime Complaint Center (IC3) — Public Service Announcement: North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment, Alert No. I-101326-PSA, issued October 13, 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---