North Korea's secret IT workforce infiltrated thousands of US companies using AI and stolen identities

North Korea's Secret US IT Workforce Infiltrated Thousands of Companies

The Wall Street Journal's year-long investigation, detailed in a 30-minute documentary titled Infiltrated: North Korea's Secret US Workforce, exposes a coordinated operation where North Korean IT workers have embedded themselves across American companies using stolen identities, AI-assisted interview fraud, and domestic facilitators to funnel salary income back to Pyongyang.

The scale is substantial. A single cell tracked by the Journal submitted applications to more than 1,000 companies over three months. The Treasury Department estimates the operation generated nearly $800 million in revenue for the North Korean government in 2024 alone, with the regime seizing as much as 90% of worker earnings.

The mechanism relies on three layers. North Korean workers use AI to automate job applications at scale and to answer technical interview questions in real time—running voice agents during interviews to feed answers when asked about specific technologies. They then use stolen American identities to pass employment screenings, often managing multiple identities simultaneously to hold several jobs under different names. Once hired, they work remotely from non-extradition countries, primarily China and Russia, connecting to company laptops hosted in the US by American facilitators who receive a cut of the salary.

Individual workers can earn as much as $300,000 annually. For one documented $75,000-a-year position, the North Korean worker and the American accomplice split the salary 50-50. The arrangement functions as passive income for the Americans involved—they receive a laptop, collect a paycheck, and remit half to their North Korean counterparts.

The operation expanded sharply during the COVID remote-work boom, when technical hiring accelerated and physical presence became unnecessary. The Journal obtained leaked browser histories, emails, calendars, and screen recordings from one cell, providing granular visibility into how the operation executes.

Human facilitators are critical to the scheme's success. These Americans host company laptops domestically, allowing overseas workers to appear as domestic employees to network monitoring and IP-based employment verification. The use of non-extradition jurisdictions as operational bases creates a legal safe harbor—the FBI has limited recourse to pursue North Korean nationals operating from countries with no US extradition treaties.

The documentary includes interviews with at least one American participant, who acknowledged potential legal consequences. One scene captures a Zoom interview where a worker, asked to say something negative about Kim Jong Un, claims audio problems and repeats that he cannot possibly comply—a moment of operational discipline caught on screen.