The Shocking Truth: How North Korean Operatives Are Stealing Remote Tech Jobs Using AI

A Belgian startup founder's quest for a coder uncovered a global cybercrime scheme. Simon Wijckmans, based in London and running the web security company c/side, encountered candidates with strong resumes but suspicious behaviors: odd accents, noisy backgrounds, and a focus on salary. Further interviews revealed more red flags, including one applicant whose glasses reflected a chatbox during the call, hinting at external assistance. Wijckmans had unknowingly stumbled upon a novel cybercrime: North Korean operatives posing as US-based remote IT workers.

These operatives used fake IDs and AI tools to secure positions at American and European tech companies. Once hired, they relied on facilitators like Christina Chapman in Arizona, who managed phony paperwork, laundered money, and operated 'laptop farms' to remotely control company-issued computers. Chapman's network, involving at least a dozen laptops, laundered millions for North Korea, duping over 300 employers, including high-profile ones.

The scheme exploited pandemic-driven remote work policies and advancements in AI, allowing operatives to harvest data or install malicious code undetected. Despite companies enhancing identity checks, fraudsters have grown more sophisticated, even using look-alikes for in-person verifications. Wijckmans now counters by tricking suspicious candidates with fake coding pages, a small act of defiance against the scheme.