Quick Summary
Amazon has blocked over 1,800 suspected North Korean scammers from applying for remote jobs since April 2024. These scammers use fake identities and AI tools to secure positions at tech companies, funneling their earnings to the North Korean regime, which the U.S. government links to funding weapons programs. The rise in such applications has increased by 27 percent quarter over quarter this year, highlighting a growing cybersecurity threat to organizations.
The Securityish Brief
Since April 2024, Amazon has identified and blocked more than 1,800 suspected North Korean scammers attempting to infiltrate its workforce. According to Amazon’s Chief Security Officer, Steve Schmidt, there has been a 27 percent increase in applications affiliated with North Korea’s Democratic People’s Republic of Korea (DPRK) this year. These scammers often utilize fake or stolen identities to apply for remote jobs at U.S. and European companies, employing AI tools to enhance their resumes and even using deepfakes during interviews.
The implications of these scams are significant, as many Fortune 500 companies have reportedly fallen victim, costing American businesses tens of millions of dollars. Once hired, these fraudsters can access sensitive company data, potentially stealing proprietary source code and extorting their employers with threats to leak information unless a ransom is paid.
Understanding the Threat
Amazon employs a combination of AI screening and human verification to combat this issue. Their AI model analyzes connections to nearly 200 high-risk institutions and detects anomalies in applications. However, the detection of fake IT workers is becoming increasingly challenging as some North Korean operatives hijack real software engineers’ identities using stolen credentials.
Additionally, these scammers often collaborate with American laptop farmers who receive corporate laptops and host computers for overseas workers, making it appear as though they are operating from within the U.S. This tactic complicates the verification process for companies.
Practical Considerations for Organizations
Organizations should be vigilant about the risks posed by these scams. Monitoring for common indicators in resumes, emails, and educational backgrounds can help identify potential fraudsters. Implementing identity verification at multiple stages of the hiring process and watching for unusual remote access patterns can mitigate risks associated with these threats.
As the landscape of remote work continues to evolve, companies must remain proactive in their hiring practices to safeguard against sophisticated scams that exploit vulnerabilities in the system.
Key Takeaways
- Implement identity verification processes at multiple stages of hiring to reduce the risk of fraudulent applications.
- Monitor for unusual remote access patterns and unauthorized hardware usage within your organization.
- Regularly review resumes and applications for common indicators of fraud, such as discrepancies in educational backgrounds.
- Utilize AI tools to help screen applications for connections to high-risk institutions.
- Educate your hiring team about the tactics used by scammers, including the use of deepfakes and fake identities.
Key Terms & Concepts
- DPRK: In this article, DPRK refers to the Democratic People’s Republic of Korea, commonly known as North Korea.
- deepfake: A deepfake is a synthetic media in which a person’s likeness is replaced with someone else’s, often used to create realistic but fake videos.
- AI screening: AI screening refers to the use of artificial intelligence technology to analyze job applications and detect potential fraud.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2025/12/18/amazon_blocked_fake_dprk_workers/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
