North Korean Fake Worker Scam Spreads Beyond IT Into Healthcare and Sales

North Korean state-linked actors have long been known to plant workers into remote IT jobs at Western companies using stolen or fabricated identities, generating revenue for the regime while creating serious insider-threat risks. New research shows this scheme is expanding beyond tech roles, with suspected operatives now found working in sales, marketing, and even medical positions.

The scheme typically relies on fake resumes, doctored credentials, and freelance or remote work platforms to get past hiring checks. Once employed, these workers can generate income for North Korea in violation of international sanctions, and in some cases gain access to sensitive systems, client data, or internal networks that could be exploited later or sold on.

For Australian small and medium businesses that rely on remote contractors or freelance staff, this trend is a reminder that identity fraud during hiring is not just an IT department problem. Any role granting access to company systems, financial processes, or customer data carries risk if the person behind the resume isn't who they claim to be.