Amazon 's chief security officer , Stephen Schmidt , says that since April 2024, the company has stopped more than 1,800 job applications likely originating from North Korean agents . The number of applications linked to North Korea has increased by about 27% per quarter in 2025.
The purpose of these applications is allegedly to obtain remote work at foreign companies, primarily in the United States, and then transfer the income to weapons program North Korea's
See also: The rise of North Korean hackers: $2 billion in cryptocurrencies stolen
What methods did Amazon use to detect fake applications?
Amazon combines AI analysis and manual review to detect suspicious applications. The algorithms look for connections to dangerous institutions, application anomalies, and geographic inconsistencies.
Identities , and structured interviews.
According to Schmidt, the company has seen several recurring trends. Identity theft is becoming more sophisticated, with scammers pretending to be real developers. accounts LinkedIn are being used to bolster credibility, and jobs in artificial intelligence and machine learning are particularly vulnerable targets.
See also: North Korean hackers exploit React2Shell to deploy EtherRAT
Some perpetrators use so-called “laptop farms” in the US to give the impression of a local presence. Fake educational credentials from US universities are also quite common. According to Amazon, even small details, such as phone numbers spelled with the country code “1”, can help uncover fake profiles.
See also: Fake North Korean job search platform targets developers in the US
Amazon says the problem is likely industry-wide and is calling on other companies to review their practices identity verification and report suspicious incidents to authorities like the FBI.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
