Loading story…
Cybercriminals are increasingly targeting individuals with fraudulent job offers, often impersonating legitimate companies or organizations to lure victims. One reported scam involves text messages claiming to be from Indeed's recruitment team, offering highly flexible remote work with unusually high pay and benefits. The messages request recipients to respond via messaging apps or phone numbers, a tactic commonly used in employment scams to extract personal information or facilitate financial fraud. Indeed has issued warnings that it does not solicit job seekers through such channels and cautions users to be wary of unsolicited offers, especially those requesting communication outside official platforms.
In a related trend, North Korean threat actors are orchestrating sophisticated fake employee schemes to secure remote positions at companies worldwide. These operations involve recruiting individuals to act as fronts for job interviews and team meetings, while the actual work is performed by North Korean operatives. The ultimate goals include stealing intellectual property, siphoning funds or cryptocurrency, and, in some cases, extorting employers. Law enforcement agencies have prosecuted individuals who knowingly participate in these schemes, highlighting the legal risks and broader security implications for organizations hiring remote workers.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A scam campaign was reported in which fraudsters impersonate Amazon recruiters in unsolicited texts offering unusually high pay for minimal remote work and pushing targets to continue over SMS, WhatsApp, Telegram, or email-to-text. The report highlighted red flags such as Hotmail addresses, vague job details, urgency, and the risk of follow-on fraud including task scams, identity theft, phishing, money mule activity, or malware delivery.
Online Threat Alerts warned of a scam impersonating Warner Bros. Discovery through unsolicited SMS and WhatsApp job offers promising unrealistic remote-work pay for simple tasks like watching videos or reviewing apps. Victims were directed to a fake portal and later pressured to pay fees to unlock higher-tier work or withdraw supposed earnings, in what was described as a phishing and advance-fee scam.
Indeed was noted as warning job seekers that it does not ask for payment or send job offers through WhatsApp, Telegram, or unsolicited phone calls. The warning was presented as guidance to help recipients identify and avoid the impersonation scam.
Reports surfaced of scam text messages impersonating Indeed Recruitment and offering high-paying remote work with unusual tasks such as updating app store data and boosting app views. The messages sought to move targets to further contact channels and appeared designed to exploit Indeed's brand to lure victims into follow-on fraud.
A North Korean operation was reported recruiting people in target countries to act as 'frontmen' for remote jobs, attending interviews and meetings while North Korean operatives performed the work or collected pay. The broader scheme was described as aimed at stealing intellectual property, generating revenue, and in some cases extorting employers, with some unwitting participants later arrested as money mules.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceblog.knowbe4.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean operatives are exploiting remote hiring processes by using fake identities and proxy workers to secure employment with international companies, thereby circumventing sanctions and gaining unauthorized access to sensitive corporate environments. Legal expert Jonathan Armstrong emphasizes the importance of robust vetting practices, such as reverse-image searches, thorough reference checks, and monitoring for suspicious IP addresses, to detect and prevent these scams. HR departments are advised to be cautious of candidates who avoid video interviews or require extended preparation time, as these behaviors may indicate fraudulent intent. Organizations are urged to follow official guidance, such as that from the U.K. Office of Financial Sanctions Implementation, to avoid inadvertently violating sanctions, which can result in severe criminal penalties. Armstrong also recommends separating hiring decisions from background checks to minimize discrimination risks and preserve evidence. Structured interviews and due diligence are critical in identifying red flags and ensuring compliance, helping companies avoid becoming unwitting accomplices to North Korean cyber operations.
Jun 29, 2026
Recorded Future's Insikt Group reported that a North Korean operation it tracks as **PurpleDelta** has used fake identities to pursue remote IT jobs at more than 1,100 companies, primarily targeting North American firms. Active since late 2024 and allegedly operating mainly from Shenyang, China, the cluster used at least 22 fabricated personas, AI-generated profile photos, forged identity documents, and recruitment infrastructure including `minicursor.com` and `trustidcard.com` to move through hiring pipelines. Investigators said the operators relied on transcription, screen recording, remote access, translation, and collaboration tools during interviews and after hiring, while in-country facilitators maintained company-issued laptops and other devices tied to victim organizations. The activity has been described as a new form of insider threat in which access is obtained during recruitment rather than abused after legitimate employment begins. SC Media reported that the FBI is investigating a North Korean remote IT worker employed by a U.S. federal agency, while broader estimates cited from the U.N. say such schemes have embedded operatives in hundreds of private-sector companies and generate **$250 million to $600 million annually**. The campaigns reportedly use stolen identities, deepfakes, VPN-masked locations, and U.S.-based laptop farms to secure remote roles and, in some cases, exfiltrate sensitive data, exposing gaps in conventional background checks and insider-threat programs.
Aug 25, 2026
A multinational government alert warns that North Korean IT workers are fraudulently securing remote jobs at companies worldwide using stolen or fabricated identities, forged documents, interview proxies, VPNs, remote-desktop tools, and overseas laptop farms. The activity generates revenue for Pyongyang's prohibited nuclear-weapons and ballistic-missile programs, while potentially exposing employers to sanctions violations and insider threats including data theft, cryptocurrency theft, and exfiltration of sensitive information. Reporting indicates North Korea is also recruiting talent abroad to expand infiltration of U.S. companies and facilitate associated money-laundering activity. Employers, staffing firms, and online work platforms should strengthen identity and right-to-work verification and investigate anomalies in interviews, account activity, device locations, payment methods, and requests to route company laptops through third parties; UN Security Council Resolution 2397 generally requires states to repatriate North Korean nationals earning income in their jurisdictions.
Sep 18, 2026