North Korea is increasingly using IT workers from other countries to gain access to US companies, evade scrutiny during recruitment and generate funds for its weapons programs, according to a report by NBC.
The reported scheme involves foreign workers acting as stand-ins during job interviews. Once a contract is secured, North Korean operatives may take over the position and use the access provided by the employer.
Interview stand-ins recruited online
NBC reported that some of the foreign workers were approached through LinkedIn and offered about $500 a month in cryptocurrency to participate part time as “interview mates.” The tactic has reportedly gained importance as the United States and other governments have increased efforts to identify and block North Korean remote-work operations.
A US government alert issued in July with several international partners warned that North Korean IT workers seek contracts with the intention of sending their earnings to North Korean entities. The alert also identified risks including insider access, data exfiltration, cryptocurrency theft and the theft of proprietary information.
Crypto remains a major source of illicit revenue
The campaign comes as North Korean-linked cyber actors continue to target the cryptocurrency industry. Citing cybersecurity firm CrowdStrike, a May report said groups affiliated with North Korea were responsible for more than $2 billion in crypto losses during 2025, representing a 51% increase from the previous year.
Despite international sanctions, the Bank of Korea estimated that North Korea’s gross domestic product grew by 3.5% in 2025. The reported use of overseas workers and corporate access schemes adds another channel through which the country can obtain foreign currency and sensitive information.
