North Korean Threat Groups Use AI to Enhance IT Worker Impersonation Schemes
North Korean state-backed threat groups are reportedly using AI tools including voice-changing software and deepfake image generation to impersonate western IT workers and obtain remote positions at American companies, from which they funnel salaries and corporate access back to Pyongyang. Microsoft reported that the schemes have infiltrated over 100 U.S. companies and involved thousands of fraudulent accounts.
What happened
North Korean state-backed fraudsters are using AI technology to apply for remote IT and software development jobs at western companies under false identities. Microsoft reported that the operatives use AI tools including voice-changing software, Face Swap, and generative AI to create fake names, alter stolen identity documents, generate professional headshots, and customize job applications.
Once hired, the fake workers send their wages back to North Korea and have been known to threaten to release sensitive company data after being fired. Microsoft identified two groups conducting these schemes, named Jasper Sleet and Coral Sleet, and said they leverage AI across the full attack lifecycle to get hired, stay hired, and misuse access at scale.
Reported impact
In June 2025, the U.S. Justice Department said the schemes had infiltrated more than 100 American companies. Microsoft shut down roughly 3,000 Outlook and Hotmail accounts in the previous year that were connected to fraudulent North Korean IT worker operations.
The FBI warned that in some cases the workers have taken sensitive corporate data or attempted to extort companies using the information.
Index analysis
The use of AI tools enables the fraudsters to create more convincing false identities and adapt applications to specific job postings at scale. Voice-changing software allows candidates to mask their accents during interviews, and deepfake image technology inserts real workers' faces into stolen IDs.
Governance controls
Microsoft advised employers to conduct IT interviews via video calls or in person to identify signs of deepfaked video and to spot other suspicious tells.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.