iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. Microsoft says it has observed North Korean remote IT workers using AI since 2024 to make fraudulent identities and job applications more convincing, obtain work at unwitting companies, and use that access to steal data or intellectual property while generating revenue for North Korea. The activity Microsoft describes is not just a malware problem: it combines hiring deception, legitimate workplace access, and state-directed espionage and income generation.
What Microsoft says the AI is being used for
In a case study published June 30, 2025, Microsoft Threat Intelligence said that North Korean remote information technology workers were leveraging AI to improve the scale and sophistication of their operations, steal data, and generate revenue for the Democratic People’s Republic of Korea (DPRK). Microsoft reports observing this AI use since 2024.
The reported use is practical: operators tailor resumes and online profiles to remote jobs, and AI-assisted application documents have become more polished and contained fewer grammatical errors. AI-enhanced worker images are also among the materials Microsoft found in repositories associated with these operations. These improvements can help a fabricated applicant look more credible, but polished writing or imagery alone does not establish that an applicant is fraudulent.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How a fraudulent remote worker can reach company systems
Microsoft’s reporting describes a campaign that builds credibility before and after an application. Rather than relying on a single fake resume, operators can assemble a broader digital footprint and then use the access granted to a successful hire.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
1. Tailor an identity to a role
Operators prepare resumes and profiles aimed at specific remote jobs. AI can help refine the language and presentation. Microsoft also found AI-enhanced worker images among the materials in operational repositories.
2. Build a supporting digital footprint
Fake personas may be backed by developer or networking profiles, purported work samples, and accounts on familiar services. Microsoft found repositories containing profiles or accounts associated with LinkedIn, GitHub, Upwork, TeamViewer, Telegram, and Skype, alongside resumes, email accounts, and work-related materials. A profile or portfolio on a mainstream service is not, by itself, proof of identity or employment history.
3. Obtain legitimate access through hiring
If an operator is hired, the access may come through ordinary employee credentials and remote-work tools. That makes the risk different from a conventional intrusion that begins with an obvious malware infection: activity can initially resemble normal work by a legitimate user.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Generate income and seek valuable information
Payments for work can generate revenue for North Korea. At the same time, access to an employer’s systems can expose company data and intellectual property. Microsoft’s broader reporting on North Korean cyber operations identifies intelligence collection against perceived adversaries, collection related to military capabilities, and cryptocurrency theft as strategic objectives; those broader objectives should not be treated as proof that every suspected remote worker carries out each one.
What Jasper Sleet means in Microsoft’s reporting
Jasper Sleet is the name in Microsoft Threat Intelligence’s June 30, 2025, case study describing this activity. The report connects AI-assisted preparation by North Korean remote IT workers with fraudulent job applications, access to unwitting employers, data theft, and revenue generation. Microsoft’s public figure for the overall scale comes from its 2025 Digital Defense Report: it says North Korea places “thousands of remote workers at unwitting companies every year” to generate revenue and gain access to sensitive intellectual property. That is a qualitative scale statement, not a more precise global count.
Microsoft’s September 2023 report on North Korean cyber operations provides broader strategic context, but it predates the June 2025 case study’s observation period for AI use. The dates and claims are distinct:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Microsoft publication or observation | What it establishes |
|---|---|
| September 2023 | Microsoft’s broader report describes North Korean cyber-operation objectives; it does not establish the later AI observation period. |
| Since 2024; reported June 30, 2025 | Microsoft Threat Intelligence says it observed North Korean remote IT workers using AI to improve operations, steal data, and generate revenue. |
| 2025 Digital Defense Report | Microsoft describes the scale as thousands of remote workers placed at unwitting companies every year; no more precise total is supplied in the cited material. |
Why detection is difficult—and what signals Microsoft identifies
A fraudulent worker may use real accounts and authorized access, so the most useful clues can be patterns of behavior rather than one definitive malware signature. Microsoft describes a machine-learning workflow that surfaces suspicious accounts using signals that include impossible-travel patterns. The company says confirmed customers can receive an Entra ID Protection risky-sign-in warning and a Defender XDR alert for sign-in activity by a suspected North Korean entity.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →These detections are product-specific and depend on the relevant Microsoft services being deployed. An alert is a signal to investigate, not a standalone finding that proves a particular employee is a North Korean operative. Companies should assess the identity, sign-in context, access and data activity together.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How companies can reduce the risk
Microsoft’s defensive guidance emphasizes vetting freelance workers and vendors. A stronger approach connects hiring checks with identity monitoring and a prepared response process.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Verify identity and work history: Apply identity and employment checks appropriate to the role, jurisdiction, and sensitivity of the access. Verify claimed references and work samples through channels independent of the applicant’s provided profiles.
- Include contractors and vendors: Make sure screening and access controls cover freelance workers and third parties, not only direct employees.
- Monitor behavior after access is granted: Review impossible-travel events, anomalous sign-ins, unusual remote-access patterns, and unexpected data movement. Treat any one signal as a reason to investigate in context, not as proof.
- Use deployed identity and endpoint alerts: Where Microsoft Entra ID Protection and Defender XDR are in use, investigate the risky-sign-in warnings and alerts Microsoft documents for suspected North Korean sign-in activity.
- Coordinate investigations: Bring insider-risk, HR, legal, and incident-response teams together when evidence warrants it, so the response addresses access, employment, data handling, and legal obligations.
- Verify AI-polished evidence: Treat unusually polished application materials, images, or portfolios as things to validate independently—not as evidence of wrongdoing or proof of legitimacy.
What the reporting does—and does not—show about AI
Microsoft’s account supports a specific conclusion: AI can help make fabricated applicant materials more convincing and support operations at greater scale and sophistication. It does not mean that every AI-assisted resume is suspicious, that AI itself grants access to company systems, or that a polished profile proves a person is genuine.
The security issue arises when deceptive identity material succeeds in passing hiring checks and is followed by access that can be misused. For that reason, employers should verify people and monitor how accounts behave rather than trying to identify a North Korean operator from writing style or an image alone. The cited Microsoft material describes AI-enhanced images and improved application documents; it does not establish that every case involves a particular interview deepfake technique.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
