Detection strategies across cloud and identities against infiltrating IT workers

Microsoft Defender research describes 'Jasper Sleet', a North Korea‑aligned threat actor that uses fabricated or stolen identities and AI-generated personas to infiltrate organizations by applying for and onboarding into remote IT roles via HR SaaS (Workday). The report outlines observed activity across pre‑recruitment (probing Workday Recruiting APIs), recruitment (external communications and document signing), and post‑recruitment (onboarding, payroll changes, access to internal SaaS), provides detection/hunting queries and mitigation guidance to identify fraudulent candidates and risky new hires.