How HR Teams Can Spot and Stop North Korean IT Worker Scams

Sep 25, 2026 · Original article ↗

Summary

North Korean operatives are using fake remote-work applications to earn income and gain access to companies. The article outlines warning signs and recommends training recruiters and improving screening and escalation processes.

Key points

Nisos monitored a suspected North Korean operator who applied for a remote AI engineering job and observed a network of 22 operators and four US-based facilitators.
During the 10-month operation, the group applied for 170,000 jobs and landed 76; Nisos says it contacted the affected companies.
A multinational advisory says the WaterPlum campaign has infected at least 30,000 devices in more than 100 countries and taken funds or credentials from over 7,000 cryptocurrency wallets.
Potential warning signs include VoIP phone numbers, VPN use, recently created email or social profiles, inconsistent digital histories, and contact details that change frequently.
No single indicator is conclusive; employers should assess multiple signals together and escalate suspicious applications early.
Companies should train recruiters, coordinate HR with IT, screen contractors as well as employees, and verify details before granting access or sending equipment.
Automated checks of phone carriers, email addresses, professional profiles, and duplicate contact details can help recruiters identify suspicious applications sooner.

Article Details

Defense Focus: Prevent North Korean IT-worker employment fraud by identifying suspicious applicants early, escalating concerns through recruiting and HR, and delaying access to company systems until appropriate screening is complete.
Detection Methods: Assess multiple applicant risk signals together rather than treating any single sign as definitive: VPN use to send documents or email, a recently created email address, VoIP as the primary phone number, and resume content reused across profiles or accounts.
Compare the age and consistency of a candidate's digital footprint, including email history, professional profiles, experience claims, and contact information.
Check whether contact details change frequently or appear duplicated across resumes, and investigate discrepancies such as an address changing when a corporate device is ordered.
Escalate applicants with aggregated risk indicators early in recruiting, before an offer or provisioning process advances.
Automate recruiter checks for phone-carrier information, email lookups, professional-profile information, and duplicated contact details.
Data Sources: Applicant resumes and profiles across accounts
Email address age and breach-notification checks
Phone numbers and carrier information
Professional-network profiles and their creation history
Applicant-provided contact and delivery addresses
Recruiting and HR screening records
Defensive Actions: Train recruiters and HR staff to recognize employment-fraud indicators and follow a documented escalation process throughout recruitment.
Coordinate HR with IT and device-provisioning teams so address changes and other inconsistencies are surfaced and investigated.
Apply role-specific screening to contractors as well as employees, before granting access to sensitive information or systems.
Use layered checks and human review; the article cautions that individual warning signs are not definitive.
Automate repeatable applicant-information checks to reduce wasted effort on likely fraudulent candidates.

People

Brian JackKnowBe4 CISO who described the company's hiring incident and applicant-screening checks.Jim DesmondHireRight CISO who discussed AI-assisted employment fraud and screening contingent workers.Nicholas KowalczykKelly Services executive who discussed applicant-risk indicators and recruitment screening.Ryan LaSalleNisos CEO who described the company's monitoring operation against a suspected North Korean IT-worker applicant.

Threat Actors

Contagious InterviewAlternative name used by other threat-intelligence firms for the actors the cited advisory calls WaterPlum.WaterPlumName used in the cited advisory for the North Korean IT-worker threat actors; the article says other threat-intelligence firms call them Contagious Interview.

Countries

AustraliaLast week, law enforcement and security agencies from the US, Japan, Australia, and Germany released an updated advisory informing companies of the risks posed by fake IT worker operations coming from the Democratic Chinadifferent facilitators in the US, all while connecting from a location on the border of North Korea and China.GermanyLast week, law enforcement and security agencies from the US, Japan, Australia, and Germany released an updated advisory informing companies of the risks posed by fake IT worker operations coming from the Democratic JapanLast week, law enforcement and security agencies from the US, Japan, Australia, and Germany released an updated advisory informing companies of the risks posed by fake IT worker operations coming from the Democratic North Koreawith four different facilitators in the US, all while connecting from a location on the border of North Korea and China.United States

Industries

Staffing and workforce solutionsvice president and chief risk, compliance, and privacy officer for Kelly Services, a staffing and workforce solutions company.Technologyin now; there are enough stories, [and] the government has come out about it. If you're hiring remote technology workers at all, you're doing yourself a disservice by not knowing at least the basics."