North Koreans Infiltrated American Companies; Workers Sent Paychecks Back to Pyongyang: Report

North Korea has quietly built a hidden workforce inside American companies, using stolen identities, artificial intelligence and U.S.-based accomplices to land remote jobs and funnel hundreds of millions of dollars back to Pyongyang.

A yearlong Wall Street Journal investigation offers one of the most detailed looks yet at how the operation works, tracing a single cell of North Korean IT workers through leaked browser histories, emails, calendars and screen recordings taken from the group's own computers. The findings are part of the Journal's documentary, "Infiltrated: North Korea's Secret U.S. Workforce."

According to the outlet, the FBI estimates that thousands of North Korean workers are applying for jobs across the United States, often posing as Americans. The cell investigated by the newspaper applied to more than 1,000 companies in just over three months.

Artificial intelligence has become central to that effort. The workers used AI to produce polished résumés and cover letters tailored to job openings. Screen recordings showed applicants reading AI-generated answers during interviews.

As recruiters have become more alert to suspicious candidates, some North Korean workers have also begun experimenting with AI-powered face-swapping technology to conceal who is actually appearing on camera.

However, if an American employer sends a corporate laptop to a new remote employee, having it delivered to Pyongyang would immediately expose the scheme. Instead, North Korean workers rely on people physically located in the United States to operate what authorities have called "laptop farms."

The Journal found that American facilitators, some aware of the scheme and others potentially unaware of its full scope, can receive and maintain company computers while North Korean workers access them remotely. Some facilitators also open bank accounts, process payments or even appear in job interviews and corporate meetings.

One Ohio man told the Journal that he attends company meetings while North Koreans perform the actual work. For one job paying $75,000 annually, he said the salary was divided evenly between him and the North Korean workers.

The system also depends heavily on identity theft. North Korean IT workers obtain Americans' personal information and use those identities to pass employment screenings. A single worker can operate under several aliases and potentially maintain multiple jobs simultaneously.

For the Americans whose identities are stolen, the consequences can extend far beyond an unauthorized résumé. The Journal interviewed a Georgia man whose identity was advertised for sale online and subsequently used by North Korean workers at jobs around the country. He said the resulting financial damage has left him unable to open a bank account, secure loans or rent a home.

The ultimate goal, U.S. authorities say, is not simply employment fraud. It is revenue generation for North Korea. The Treasury Department has warned for years that Pyongyang dispatches thousands of highly skilled IT workers who disguise their identities and nationalities to obtain employment around the world. Individual workers can earn more than $300,000 annually, according to Treasury.

In January 2025, Treasury said the North Korean government can withhold as much as 90% of overseas IT workers' wages, directing hundreds of millions of dollars toward government priorities, including weapons of mass destruction and ballistic missile programs.

The operation appears to have continued expanding. In March, Treasury said North Korean IT worker schemes generated nearly $800 million in 2024 alone and sanctioned six individuals and two entities accused of helping defraud American businesses. Authorities also warned that some North Korean workers have used their access to introduce malware and extract proprietary or sensitive corporate information.