North Korean state-backed hackers are using artificial intelligence tools, including voice-changing software and face-swapping apps, to trick Western companies into hiring them for remote IT jobs, Microsoft has warned. The tech giant's threat intelligence unit revealed that the scammers, tracked under the names Jasper Sleet and Coral Sleet, are employing AI to create fake identities and alter stolen documents to secure employment and funnel wages back to Pyongyang.
According to a blogpost from Microsoft, the fraudsters use AI to generate 'culturally appropriate' name lists and email formats to construct convincing false identities. They have also been known to use voice-changing software during remote interviews to mask their accents, helping them pose as Western candidates. The AI tool Face Swap is used to insert the faces of North Korean IT workers into stolen identity documents and to produce polished headshots for CVs.
The scammers target job platforms such as Upwork, using AI to analyse job postings and tailor their applications to specific skill requirements. Once hired, they rely on AI to write emails, translate documents, and generate code to avoid detection. Microsoft said Jasper Sleet 'leverages AI across the attack lifecycle to get hired, stay hired, and misuse access at scale'.
Last year, Microsoft disrupted 3,000 accounts linked to fake North Korean IT workers. The company urged businesses to conduct job interviews in person or via video to mitigate the threat, and noted that deepfake videos can be spotted by looking for pixelation around faces, eyes, ears, and glasses, as well as inconsistencies in lighting.
