North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment
Foreign state-controlled remote IT workers use paid local helpers to get and keep jobs at U.S. companies. The workers hide their identities and locations behind stolen documents and the people they recruit.
How it works
Fake job listings appear on well-known job boards, often framed as freelance gigs. The posting asks for simple help, such as interviewing on someone's behalf or receiving and hosting a laptop at home. The requester tells a made-up backstory and supplies official-looking documents to seem legitimate. Helpers are then paid to verify identities, ship packages, or keep work devices connected from their homes.
Red flags to watch for
- Freelance job asks you to interview for someone else
- Offer to receive and host a company laptop at home
- Pay offered for verifying identity or sharing account logins
- Requests to ship packages or keep devices connected
- Backstory about needing a temporary U.S. presence or displacement
What to do
Do not interview for anyone, accept or forward laptops, or share personal details, bank logins, or account access for pay. Decline the offer and stop replying to the sender. If you have been threatened or fear for your safety, call 911 right away. Report the posting to the job board and file a complaint at ic3.gov, and if you are already doing this work for an employer, tell that company's security or HR team.
If this reached you
Source: FBI IC3 . Scam Sentinel summarizes official guidance in plain language; it is a decision aid, not a guarantee.