Michael Barnhart sampled 20 Fortune 500 companies not long ago. In 18 of them he found evidence that North Korean IT workers had applied, worked there or targeted the firm. Barnhart, a former Army intelligence specialist who now tracks the workers for the cybersecurity firm DTEX, told Fox News the scale surprised even him.
Thousands of operatives are applying for remote jobs at U.S. companies, and many are hired. They use stolen American identities, U.S.-based “laptop farms” and artificial intelligence that writes résumés and feeds them answers in interviews. The Treasury Department says the state-directed workforce brought in nearly $800 million for North Korea in 2024 alone, money that helps pay for the regime’s weapons programs. “The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” Treasury Secretary Scott Bessent said.
How the laptop farms work
A company that ships a work laptop to an address in North Korea, Russia or China would spot the problem at once. So the operatives recruit Americans to receive the machines and host them, which makes the employee look like a U.S. resident. Some hosts keep dozens of computers for dozens of companies.
Christina Chapman of Arizona ran one. She was sentenced in 2025 to more than eight years in prison after pleading guilty to conspiracy to commit wire fraud, aggravated identity theft and conspiracy to launder monetary instruments. The Justice Department said she helped North Korean workers get jobs at more than 300 U.S. companies, among them several Fortune 500 firms, a major television network, an aerospace manufacturer and an American carmaker. She shipped 49 laptops overseas, including to China, and agents seized more than 90 from her home in October 2023. She even kept notes on which company belonged to which machine.
Some facilitators know exactly what they are doing. Others, Barnhart said, are “hoodwinked” into thinking they are helping a foreign developer or picking up easy passive income. Recruiters look for them on Reddit, Discord, Telegram, WhatsApp and Craigslist, and they favor people short of money. “They like them poor because you need that incentive to dangle in front of them,” he said. The first offer might be a few hundred dollars. The asks grow over the years.
One recruitment message Barnhart gave Fox News asks for a native English speaker to join Google or Zoom meetings “with the given profile name” and “pretend to be someone else during interviews.”
Adapting as employers catch on
Old tells are fading. An applicant who claimed to be American-born might stumble on questions about his supposed hometown, carry an unexpected accent or visibly read from another screen. Now, Barnhart said, operatives use generative AI and interview-assistance tools to answer in real time, plus deepfakes as companies get better at screening. They also work through intermediaries in countries including Pakistan, India and Nigeria, and exploit third-party contractors. “As soon as everyone has a lead on them, they like to switch,” he said.
Identity theft is part of it. The Wall Street Journal profiled Michael Brown, whose identity North Korea used to get jobs at no fewer than two companies. U.S. Attorney Jeanine Ferris Pirro called the country “an enemy within” that is “perpetrating fraud on American citizens, American companies and American banks.”
More than a paycheck
Barnhart once saw the workers mainly as a money operation and watched North Korea’s elite hacking units instead. Then investigators found the two intertwined. A hired worker holds legitimate credentials, a company laptop and trusted access, so the company has in effect let the operative in. At a retailer the aim may be only a salary. At a defense contractor, a pharmaceutical firm or a critical infrastructure operator, the same worker is worth far more.
“Do they have the placement and access to do it? Yes, I can tell you right now, verified,” Barnhart said. “I’ve seen them in places we do not want them to include critical infrastructure as well.” He described the workers as insiders who can “open the door” for more skilled hackers.
The scheme predates COVID-19, he said, and has roots more than a decade back. Then millions of Americans began working from home. “Once the pandemic hit, it became absolute gasoline on a fire.”
