North Korea has expanded a long-running operation that places fake IT workers inside U.S. and global technology companies, using recruits in third countries to help its operatives pass job interviews and bypass identity checks.

JUST IN: North Korea is reportedly using foreign workers to help its operatives infiltrate U.S. companies through fake remote job applications. pic.twitter.com/m3D3TJQ43R — EyeWhales (@EyeWhales) September 12, 2026

According to a September 11, 2026, NBC News report citing U.S. officials and cybersecurity researchers, the network now includes facilitators in Nigeria, South Africa, Iran, India and parts of Latin America.

The basic method involves North Korean IT workers applying for remote technology jobs at foreign companies. After a contract is secured, a North Korean operative typically takes over the position, while the resulting salary is sent back to Pyongyang. The money is believed to support sanctioned programs, including North Korea’s weapons-development efforts.

The use of third-country facilitators separates the person appearing during the hiring process from the person who ultimately performs the work. That makes conventional interview-based identity checks less reliable when employers do not verify who is carrying out the contracted work.

How facilitators are recruited

Cybersecurity firm Flare found that North Korean operators are scouting developers on platforms including LinkedIn. In some cases, recruits are offered about $500 per month to act as “interview associates.” They appear on camera during job interviews while posing as the actual applicants.

In one message reviewed by researchers, a North Korean operator told a potential recruit: “You’re from a country that is under sanctions. If you’re still interested in the role, I need to confirm whether you’re comfortable working under someone else’s identity.”

Iran is among the countries being targeted partly because local developers have limited access to international work as a result of sanctions imposed on their own country. That restriction may make some developers more open to such arrangements.

Cybersecurity firms Kudelski Security and DTEX separately confirmed that developers in South Africa, Syria, Iran, Nigeria, Pakistan and parts of Latin America have been approached through the network.

Scale of the operation

The United Nations estimates that North Korea’s remote IT worker schemes generate up to $600 million annually. A U.S.-led sanctions-monitoring assessment put the figure as high as $800 million in 2024.

Broader U.S. intelligence assessments estimate North Korea’s total annual earnings from cyber activities, including IT worker schemes and cryptocurrency theft, at at least $1 billion. The scheme involving remote workers is also estimated to generate between $600 million and $800 million per year.

In May 2026, cybersecurity company CrowdStrike reported that North Korean state-affiliated hackers were responsible for more than $2 billion in cryptocurrency losses in 2025, a 51% year-on-year increase.

North Korea’s gross domestic product grew an estimated 3.5% in 2025, according to the Bank of Korea, despite continuing international sanctions.

In July 2026, the U.S. State Department and Department of Justice issued a joint warning with foreign agencies that North Korea was using “increasingly sophisticated” tactics to recruit people outside its borders and conceal its operatives’ identities.

Blockchain firm Consensys previously disclosed that it had unknowingly outsourced developer work to a North Korean operative.