North Korean Hackers Are Stealing Remote Jobs with American Help—Here's How

A federal judge in Massachusetts recently sentenced Kejia "Tony" Wang to nine years in prison for orchestrating a massive fraud operation that placed North Korean IT workers in tech jobs at over 100 U.S. companies, including Fortune 500 firms. The scheme, which ran for three years, involved stealing identities of more than 80 Americans, forging documents, and generating over $5 million in salary payments before being uncovered.

Wang's network used stolen identities to create fake social security cards, driver's licenses, and tax documents. Once hired, the North Korean workers performed remote IT jobs while their salaries were funneled back to the regime of Kim Jong Un, funding nuclear weapons development. The U.S. Department of Justice has now convicted at least seven Americans for aiding this scheme, including a former Army soldier, a nail technician, and an Arizona woman.

The Role of American Facilitators

According to Assistant Attorney General John Eisenberg, "North Korean IT worker schemes would not be successful without U.S.-based facilitators." These facilitators operate "laptop farms," create front companies, and provide fake identification. Some are sophisticated operators, while others are naive college students lured by quick cash.

Cybersecurity investigator Michael Barnhart of DTEX described a sting operation where a young man named "David" showed up in person to verify his identity for a job—only to be a proxy for a North Korean worker. Another facilitator, "Aaron," accepted a laptop shipment in Minnesota. Both denied involvement when contacted, but their identities continue to circulate in the scheme.

AI Amplifies the Threat

Artificial intelligence has supercharged the fraud. During live job interviews, AI can convert a North Korean accent into a convincing American voice in real-time. The regime has built an "industrial hiring machine" with specialists for resume crafting, interviews, and actual work.

Identities That Never Die

Even after facilitators walk away or are arrested, their stolen identities remain active. Barnhart tracked two identities that resurfaced as board members of a front company months after he thought they were dormant. "The fake Aaron and the fake Davids are still very alive, very well, and still doing IT work," he said.

The Human Cost

Beyond national security, the scheme steals jobs from Americans who need them most—people with disabilities, caregivers, and those with limited mobility. These well-paying remote positions are "gold mines" for families, said Palo Alto Networks' Evan Gordenker.

What Can Be Done?

Experts urge companies to overhaul hiring processes, including rigorous identity verification, video interviews with behavioral cues, and monitoring for anomalies like accent changes or refusal to appear on camera. The U.S. government has conducted raids and seized fraudulent websites, but the scale of the problem demands ongoing vigilance.