North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees

Researchers created a fake DeFi company to hire and monitor DPRK-linked operatives and observed a persistent insider-infiltration campaign: operatives used AI-forged IDs and stolen identities to pass hiring checks, installed remote-access tools (Google Remote Desktop, AnyDesk), routed activity through AstrillVPN and proxies, used ChatGPT/live-translation for development, and exfiltrated credentials and browsing histories — demonstrating a sophisticated, long-term insider threat model tied to Famous Chollima/Lazarus.