North Korea has quietly placed thousands of IT workers inside U.S. companies using stolen and rented identities, artificial intelligence tools and remote-work arrangements to generate hard currency for the regime while evading international sanctions, according to a Wall Street Journal investigation.
Investigators say generative AI has become an increasingly important tool throughout the scheme. According to Okta researchers, operatives use AI to draft résumés, translate conversations in real time and generate responses during technical interviews. Real-time deepfake technology has also advanced to the point that 11 governments issued a joint advisory in 2026 warning employers that live video interviews alone are no longer sufficient to verify an applicant’s identity.
Some American facilitators are themselves victims of identity theft, while others knowingly participate by renting out their identities in exchange for a share of the salary, Fortune reported. The U.N. Panel of Experts has linked the IT-worker programme to North Korea’s Munitions Industry Department and estimates it generates between $250 million and $600 million annually for the regime. The operation forms part of a broader sanctions-evasion ecosystem that U.N. investigators say has generated billions of dollars through cyber theft, fraud and other illicit activities.
The financial returns are only part of the concern. Once inside corporate networks, some workers have gained access to proprietary software, sensitive customer data and internal systems, creating opportunities for espionage, intellectual-property theft and, in some cases, extortion after their fraudulent identities were uncovered.
The scheme highlights how advances in artificial intelligence, remote work and digital identity have created new opportunities for sanctioned states to generate revenue from inside legitimate Western businesses. For governments and employers alike, the challenge is no longer simply detecting fraudulent applicants, but preventing hostile states from turning the global digital workforce into a source of strategic financing and potential intelligence access.
