DPRK Remote IT Worker Scheme Uses Impersonated Real LinkedIn Accounts to Infiltrate Employers
Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Feb 10, 2026
North Korean (DPRK) operatives running the long-standing “remote IT worker” scheme have escalated their tradecraft by applying for remote roles using real LinkedIn accounts of legitimate professionals they are impersonating, rather than relying primarily on fully synthetic personas. Reporting attributes the finding to analysis shared by Security Alliance (SEAL), noting that the hijacked/impersonated profiles can appear highly credible—sometimes featuring verified workplace emails and identity badges—making initial recruiter screening and identity verification more difficult.
The operation’s objectives remain consistent: generate revenue for the regime (including via salary payments later moved through cryptocurrency laundering techniques such as chain-hopping/token swapping and use of DEXs/bridges) while also enabling access to sensitive corporate environments for espionage, persistence, and potential follow-on extortion. The activity is described as high-volume and is tracked under multiple names in the security community (including Jasper Sleet, PurpleDelta, and Wagemole), with prior research noting that once placed, these operators can obtain administrative access to codebases and blend in using living-off-the-land techniques within enterprise infrastructure.
