These Hackers Didn’t Break In... They Got Hired - North Korea’s Fake Workers

The front door was a job application

Some attackers look for a software flaw. The workers in this story tried a different route: they applied for jobs.

Recorded Future’s Insikt Group uses the name PurpleDelta for activity associated with North Korean IT workers. The researchers identified several clusters involving operators who were likely based in China and who posed as ordinary remote applicants.

One cluster applied to jobs at more than 1,100 companies between late 2024 and early 2025. The applications concentrated on software and technology, staffing and consulting, and healthcare and biotechnology. Across the broader activity, the researchers found applications in financial services too.

This was not one person sending the same resume everywhere. Recorded Future identified at least 22 fabricated personas. On some days, operators applied to 60 or more positions across at least eight job platforms.

The applicants could look convincingly normal

The personas were supported by realistic resumes, AI-generated profile photos, identity documents from an illicit generation service, separate browser profiles, and detailed tracking spreadsheets.

During interviews, operators used transcription and chatbot tools to help produce answers in real time. They sometimes repeated those answers word for word, including incorrect ones. The reporting also describes real technical ability. A manager in one recorded meeting praised an operator’s coding while criticizing an absence and poor communication.

That combination matters. A candidate does not need to look perfect. They only need to look like a plausible employee.

Recorded Future assessed that the clusters were highly likely to have been actively employed by at least 10 organizations. That is the researchers’ confidence judgment, not a public list of 10 independently confirmed employers. The observed industries included AI, financial technology, IT services, media, and nonprofit organizations.

Once inside, some operators recorded internal meetings and work sessions. The researchers also identified facilitators who received and maintained company hardware for the operators.

The psychology: Truth-Default Theory

Truth-Default Theory starts with a simple idea: people generally believe other people unless something creates enough doubt to trigger closer scrutiny.

That default is useful. A hiring team could not function if every sentence in every interview were treated as a possible lie. Most of the time, ordinary trust lets communication move forward.

The risk appears when familiar cues do more work than independent evidence. A polished profile, a normal-looking video call, a detailed resume, and competent answers can all make the same story feel consistent. Consistency helps a person sound believable. It does not verify who is behind the story.

Truth-Default Theory also emphasizes context and what people communicate, not a magic list of nervous gestures that reveals deception. The answer is not to guess who looks suspicious. The answer is to put reliable checks around the moments where trust creates access.

Fact, interpretation, and uncertainty

The persona count, application volume, observed tools, likely employment, and recorded work activity come from Recorded Future’s investigation and independent reporting on it.

The Truth-Default Theory connection is Connor’s cyberpsychology interpretation. It does not prove why any specific recruiter or manager accepted an applicant. High application volume, staffing gaps, fragmented background checks, and real technical ability may all contribute.

The public reporting does not identify every company that received an application or employed a suspected worker. It also does not establish that every applicant using an unusual device, location, or interview tool is part of this activity.

Make verification part of hiring

Remote hiring should include security checks, but those checks should be clear and consistent for everyone. Verify identity during hiring and onboarding, then repeat appropriate checks during employment. Confirm work and education history directly. Make sure company equipment reaches the verified person.

After hiring, start with the access the job actually needs. Review unusual remote-access tools, device locations, and requests to use personal equipment. Give hiring, IT, and security a shared way to pause access when an identity does not add up.

This is not about distrusting every remote employee. It is about separating a good impression from a completed verification process.

Believable is not the same thing as verified. Sometimes the breach begins with onboarding.