North Korea Recruits Global Workers to Plant Fake IT Staff in US Tech Companies

Key Takeaways Pyongyang is enlisting IT professionals in Nigeria, South Africa, Iran, and India to facilitate the placement of fraudulent workers at American corporations These international “interview proxies” receive approximately $500 monthly compensation, often paid via cryptocurrency After securing employment contracts, North Korean agents assume control of the positions and funnel wages to Pyongyang Intelligence estimates suggest this operation produces between $600 million and $800 million per year for North Korea Total North Korean cyber operations, including cryptocurrency theft, resulted in over $2 billion in damages during 2025 Pyongyang has significantly scaled up its ongoing campaign to embed fraudulent IT professionals within American and international technology corporations. This sophisticated operation now depends on third-party accomplices in various countries who assist North Korean agents in clearing job interviews and evading verification processes. JUST IN: North Korea is reportedly using foreign workers to help its operatives infiltrate U.S. companies through fake remote job applications. pic.twitter.com/m3D3TJQ43R — EyeWhales (@EyeWhales) September 12, 2026 Based on an NBC News investigation published on September 11, 2026, which drew from US government sources and cybersecurity specialists, this network has expanded to encompass participants in Nigeria, South Africa, Iran, India, and several Latin American nations. The operational framework is relatively simple. North Korean technology workers submit applications for remote positions at international companies. After successfully obtaining a contract, an operative from North Korea generally assumes the actual work responsibilities. Compensation is subsequently transferred to the North Korean government. Intelligence agencies believe these funds directly support programs under international sanctions, particularly North Korea’s nuclear and ballistic missile initiatives. Recruitment Tactics for Proxy Workers Research conducted by cybersecurity organization Flare revealed that North Korean handlers actively pursue software developers through professional networking sites like LinkedIn. Selected individuals receive offers of roughly $500 per month to serve as “interview stand-ins,” appearing via video conferencing during hiring processes while impersonating the real candidate. Researchers examined one communication where a North Korean handler explained to a prospective accomplice: “You’re from a country that is under sanctions. If you’re still interested in the role, I need to confirm whether you’re comfortable working under someone else’s identity.” Nations such as Iran represent prime targets because developers there experience restricted opportunities for legitimate international employment due to existing sanctions regimes, increasing their susceptibility to these proposals. Security research organizations Kudelski Security and DTEX have independently verified that software professionals in South Africa, Syria, Iran, Nigeria, Pakistan, and Latin American regions have been contacted through this recruitment network. Magnitude of the Campaign United Nations analysts calculate that North Korea’s remote technology worker operations generate approximately $600 million annually. A sanctions monitoring report coordinated by US authorities estimated the total reached $800 million throughout 2024.