Microsoft: North Korea uses AI to remotely recruit scammers to Western companies

North Korea is using artificial intelligence tools, including voice-changing programs, to help its agents trick their agents into getting jobs with Western companies. Microsoft reported this in a publication from its cyber threat intelligence division.

According to the company, the scheme is as follows: scammers affiliated with Pyongyang apply for remote IT vacancies in the West, using fake identities and the help of intermediaries in the country where the employer is registered. After employment, they transfer their earnings to Kim Jong-un’s state, and if fired, they often threaten to disclose confidential company data. Microsoft is tracking groups called Jasper Sleet and Coral Sleet involved in the scheme.

Specific tools used by scammers include voice changers in interviews to disguise accents and impersonate Westerners. The Face Swap app helps insert the faces of North Korean workers into stolen IDs and generate “professional” photos for resumes. AI is also used to create lists of “culturally appropriate” names and corresponding email addresses, such as the query “make a list of 100 Greek names.” In addition, scammers use neural networks to analyze job postings on platforms like Upwork to tailor their applications to the requirements of specific employers.

Once hired, AI helps maintain the appearance of normal operations by writing letters, translating documents, and generating code. Microsoft called on employers to conduct interviews with IT specialists via video or in person and listed the signs of deepfakes - pixelation along the contours of the face, ears and glasses, as well as incorrect interaction with light sources. The company previously reported that it had blocked three thousand Outlook and Hotmail accounts used by North Korean scammers.

Earlier, the US Department of Justice accused the North Korean authorities of organizing a fraudulent scheme in which citizens of the country were deceived into getting remote jobs in American IT companies, and the money earned was used to finance the regime, including weapons programs. According to the department, the salaries of fictitious employees reached $300 thousand a year, and total revenues amounted to hundreds of millions of dollars.