Fake IT workers deployed by North Korea are using artificial intelligence technology, including voice-changing tools, to trick Western companies into hiring them, Microsoft said.
The US technology firm said artificial intelligence is improving a signature Pyongyang money-raising ruse, which is helping to create fake names and alter stolen IDs to boost the credibility of fake applicants for IT and software development jobs.
The scam typically involves state-backed scammers applying for remote IT work in the West, using fake identities and the help of “facilitators” in the country where the target company is based. Once hired, they send their salaries back to Kim Jong-un’s state and have even been known to threaten to reveal confidential company data after being fired.
According to a blog post from Microsoft’s threat intelligence unit, Pyongyang is using AI to bolster the effectiveness of its strategy.
Microsoft listed a series of AI-related scams used by North Korean groups, called Jasper Sleet and Coral Sleet, in keeping with the convention of cybersecurity analysts who give nicknames to groups of anonymous raiders.
The technology company said scammers had used voice-changing software during remote interviews to mask their accent, allowing them to pose as Western candidates. They also use the AI app Face Swap to insert the faces of North Korean IT workers into stolen ID documents and generate “polished” headshots for CVs.
“Jasper Sleet leverages AI throughout the attack lifecycle to get hired, stay hired, and misuse access at scale,” Microsoft said.
Last year, Microsoft said it had disrupted 3,000 Microsoft Outlook or Hotmail accounts used by fake North Korean IT workers.
Microsoft said the fake workers had used artificial intelligence platforms to generate lists of “culturally appropriate” names and matching email address formats to construct fake identities for job applications. The company said an example message could be “create a list of 100 Greek names” or “create a list of email address formats using the name Jane Doe.”
They also use AI to search job postings for software and IT-related roles on job platforms like Upwork, and then use the skill requirements listed in those ads to create more effective applications. Upwork has said that “aggressive measures are needed to…remove bad actors from our platform.”
Once hired, the fake workers use artificial intelligence to write emails, translate documents and generate code while trying to avoid being discovered as a fraud or fired for poor performance, Microsoft said.
Companies have also been urged to conduct job interviews for IT workers on video or in person to avoid the threat. Microsoft added that interviewers can detect a deepfake video or image through a number of “cues,” such as pixelation at the edges of faces, eyes, ears and glasses, and inconsistencies in how light interacts with an AI-generated face.
