AIPolicyTracker
Menu

AI incident ·

Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers

41 news reports Snapshot 7 Sep 2026

In brief

An AI system built by Openai, Large Language Model Developers and 1 other and deployed by Yang Di, Waterplum and 31 others allegedly harmed Western Companies, Web3 and 22 others.

Risk domain
Malicious Actors & Misuse Fraud, scams, and targeted manipulation
Occurred
Coverage
41 reportsMay 2022 - Nov 2025

What happened

North Korean operatives have reportedly used AI-generated identities to secure remote jobs or impersonate employers in order to infiltrate companies. These tactics allegedly support sanctions evasion through wage theft, credential exfiltration, and malware deployment. Workers reportedly use fake resumes, VPNs, and face-altering tools; some deploy malware like OtterCookie after embedding, while others lure targets via spoofed job interviews. AI systems are reportedly used to generate fake resumes

Laws that address this harm

Policy angle: Classified under Malicious Actors & Misuse (Fraud, scams, and targeted manipulation) in the MIT AI Risk Repository taxonomy; 5 recorded instruments address this use case.

Matched from the record's risk domain and country to the instruments recorded here. A reviewer can correct the match in the repository (data/external/incident_overrides.yaml).

News reports (41)

Titles link to the original publisher; report text is not reproduced here.

  1. Publication of North Korea Information Technology Workers Advisory
    ofac.treasury.gov · United States Department of the Treasury, Office of Foreign Assets Control
  2. Justice Department Announces Court-Authorized Action to Disrupt Illicit Revenue Generation Efforts of Democratic People’s Republic of Korea Information Technology Workers
    justice.gov · United States Department of Justice, Office of Public Affairs
  3. Charges and Seizures Brought in Fraud Scheme Aimed at Denying Revenue for Workers Associated with North Korea
    justice.gov · United States Department of Justice, Office of Public Affairs
  4. Arizona woman arrested and charged in North Korean IT worker scheme
    cyberscoop.com · AJ Vicens
  5. How a North Korean Fake IT Worker Tried to Infiltrate Us
    blog.knowbe4.com · Stu Sjouwerman
  6. Cyber firm KnowBe4 hired a fake IT worker from North Korea
    cyberscoop.com · Matt Bracken
  7. Justice Department Disrupts North Korean Remote IT Worker Fraud Schemes Through Charges and Arrest of Nashville Facilitator
    justice.gov · United States Department of Justice, Office of Public Affairs
  8. Nashville man arrested for aiding North Korean remote IT worker fraud
    cyberscoop.com · Greg Otto
  9. KnowBe4 Issues Warning to Organizations After Hiring Fake North Korean Employee
    knowbe4.com · KnowBe4
  10. Staying a Step Ahead: Mitigating the DPRK IT Worker Threat
    cloud.google.com · Mandiant, Codi Starks, Michael Barnhart
  11. Firm hacked after accidentally hiring North Korean cyber criminal
    bbc.com · Joe Tidy
  12. KnowBe4 Launches Complimentary Training Module Following Thwarted North Korean Infiltration Attempt
    knowbe4.com · KnowBe4
  13. Fourteen North Korean Nationals Indicted for Carrying Out Multi-Year Fraudulent Information Technology Worker Scheme and Related Extortions
    justice.gov · United States Department of Justice, Office of Public Affairs
  14. Court indicts 14 North Korean IT workers tied to $88 million in illicit gains
    cyberscoop.com · Tim Starks
  15. Treasury sanctions North Korea over remote IT worker schemes
    cyberscoop.com · Greg Otto
  16. Two North Korean Nationals and Three Facilitators Indicted for Multi-Year Fraudulent Remote Information Technology Worker Scheme that Generated Revenue for the Democratic People’s Republic of Korea
    justice.gov · United States Department of Justice, Office of Public Affairs
  17. DOJ indicts five in North Korean fake IT worker scheme
    cyberscoop.com · Matt Bracken
  18. Arizona Woman Pleads Guilty in Fraud Scheme That Illegally Generated $17 Million in Revenue for North Korea
    justice.gov · United States Department of Justice, Office of Public Affairs
  19. The North Korea worker problem is bigger than you think
    cyberscoop.com · Matt Kapko
  20. Mitigate Rising Candidate Fraud Through Identity Verification
    gartner.com · Emi Chiba, Akif Khan, Hiten Sheth
  21. North Korean IT workers are spamming tech firms with fake résumés. One founder says he came up with ‘a foolproof way’ of weeding them out
    fortune.com · Amanda Gerut
  22. Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation
    unit42.paloaltonetworks.com · Evan Gordenker
  23. The one interview question that will protect you from North Korean fake workers
    theregister.com · Iain Thomson
  24. North Korean operatives have infiltrated hundreds of Fortune 500 companies
    cyberscoop.com · Matt Kapko
  25. North Korea Stole Your Job
    wired.com · Bobbie Johnson
  26. How to spot and expose fraudulent North Korean IT workers
    techtarget.com · Alissa Irei
  27. OtterCookie v4 Adds VM Detection and Chrome, MetaMask Credential Theft Capabilities
    thehackernews.com · Ravie Lakshmanan
  28. Tech companies have a big remote worker problem: North Korean operatives
    politico.com · Maggie Miller, Dana Nickel
  29. China helps North Korean operatives land IT roles, bypassing sanctions
    cybersecuritydive.com · Eric Geller
  30. North Korean IT Workers Are Being Exposed on a Massive Scale
    wired.com · Matt Burgess
  31. 4 Ways to Stop Fake Applicants—and Remote Employees—In This North Korean Job Scam
    inc.com · Bruce Crumley
  32. Exposing DPRK: Nation-State Threat Actors
    dtexsystems.com · DTEX
  33. North Korea Infiltrates U.S. Remote Jobs—With the Help of Everyday Americans
    wsj.com · Robert McMillan, Dustin Volz
  34. Combat Candidate Fraud With Strengthened Hiring Practices
    gartner.com · Hiten Sheth, Emi Chiba
  35. U.S. Seizes $7.74M in Crypto Tied to North Korea's Global Fake IT Worker Network
    thehackernews.com · Ravie Lakshmanan
  36. Tricked on Zoom: Deepfake Scam Leads to macOS Breach
    the420.in · Ayush Chaurasia
  37. AI chatbots, deepfake software, and fake ID generators help automate crypto scams: Report
    thehindu.com · The Hindu Bureau
  38. Arizona woman sentenced over $17 million North Korea worker fraud scheme
    washingtonpost.com · Frances Vinall
  39. Detecting and countering misuse of AI: August 2025
    anthropic.com · Anthropic
  40. North Korean operatives running fake job portal targeting US AI firms
    edition.cnn.com · Sean Lyngaas
  41. Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent
    validin.com · Validin

Who was involved

Alleged harmed party
Western Companies, Web3, Ssa, Social Security Administration, Recruitment Teams, Oleksandr Didenko, National Security And Intelligence Stakeholders, Macos Users, Jiho Han, Irs, Interviewees, Internal Revenue Service, Human Resources Staff, Hiring Managers, Haoran Xu, Epistemic Integrity, Employers, Developers, Cryptocurrency Platforms, Companies In The United States, Chunji Jin, Blockchain Projects, Andrew M., Targets Of Fraudulent Professional Opportunities

Classification (MIT AI Risk Repository taxonomy)

Causal entity
Human
Intent
Intentional
Timing
Post-deployment
Harm level
—
Sectors
—
Countries
—

Risk entries describing this failure mode

Entries from the MIT AI Risk Repository coded to subdomain 4.3.

  • Cheating/plagiarism

    "Cheating/plagiarism - Use of another person’s or group’s words or ideas without consent and/or acknowledgement."

    A Collaborative, Human-Centred Taxonomy of AI, Algorithmic, and Automation Harms (Abercrombie2024)

  • IP/copyright loss

    "IP/copyright loss - Misuse or abuse of an individual or organisation’s intellectual property, including copyright, trademarks, and patents."

    A Collaborative, Human-Centred Taxonomy of AI, Algorithmic, and Automation Harms (Abercrombie2024)

  • Financial and business

    "Financial and Business - Use or misuse of a technology system in a manner that damages the financial interests of an individual or group, or which causes strategic, operational, legal or financial harm to a business or...

    A Collaborative, Human-Centred Taxonomy of AI, Algorithmic, and Automation Harms (Abercrombie2024)

  • Impersonation/identity theft

    "Impersonation/identity theft - Theft of an individual, group or organisation’s identity by a third-party in order to defraud, mock or otherwise harm them."

    A Collaborative, Human-Centred Taxonomy of AI, Algorithmic, and Automation Harms (Abercrombie2024)

  • Dehumanisation/objectification

    "Dehumanisation/objectification - Use or misuse of a technology system to depict and/or treat people as not human, less than human, or as objects."

    A Collaborative, Human-Centred Taxonomy of AI, Algorithmic, and Automation Harms (Abercrombie2024)

  • Defamation/libel/slander

    "Defamation/libel/slander - Use of a technology system to create, facilitate or amplify false perception(s) about an individual, group, or organisation."

    A Collaborative, Human-Centred Taxonomy of AI, Algorithmic, and Automation Harms (Abercrombie2024)

  • Misinformation and Manipulation

    "Recent studies have demonstrated that LLMs can be exploited to craft deceptive narratives with levels of persuasiveness similar to human-generated content (Pan et al., 2023b; Spitale et al., 2023), to fabri- cate fake n...

    Foundational Challenges in Assuring Alignment and Safety of Large Language Models (Anwar2024)

  • Cybersecurity

    "LLMs may exacerbate cybersecurity risks in various ways (Newman, 2024). Firstly, LLMs may significantly amplify the effectiveness of deceptive operations aimed at tricking people into disclosing sensitive information or...

    Foundational Challenges in Assuring Alignment and Safety of Large Language Models (Anwar2024)

Incidents in the same risk subdomain

All incidents in this subdomain

Source record: incident #1118 on the AI Incident Database · all 41 reports