The Fake Job Applicant Who Walked Into the Firm Hunting Him

There is a specific kind of irony in a North Korean fake IT worker applying for a job at the company that investigates North Korean fake IT workers. That is exactly what landed in the inbox of risk intelligence firm Nisos in June 2025, when a supposed Florida-based AI architect sent through a resume that read suspiciously like the job ad itself.

The red flags stacked up before the first interview even finished. His CV listed software that did not exist during the years he claimed to have used it. The email address was freshly created. The phone number was VoIP. Different versions of the resume contradicted each other in small but telling ways.

The hurricane that never happened

On video calls, his eyes drifted across the screen as he answered, as though he was reading. Nisos suspected an AI tool was feeding him lines in real time, so they tried something simple. They invented a hurricane and asked how it had affected his Florida home. He described minor rain and wind from a storm that had not happened.

That alone would have been enough to end the conversation. Instead, Nisos kept going.

Following the trail

Canary tokens traced his connection to Astrill VPN, a service long associated with North Korean operatives. The delivery address he gave for the work laptop matched neither his resume nor the identity of the real Floridian whose details he had stolen.

So Nisos shipped a rigged laptop to the address and switched on the camera once it arrived. Inside a closet sat a stack of machines, around 40 devices with roughly 20 in active use. They were wired together through a Tailscale mesh VPN and driven remotely with PiKVM hardware, the kind of kit that lets an operator control a computer as if they were sitting in front of it.

Welcome to the laptop farm

This setup has a name now. The industry calls it a laptop farm. An American, knowingly or otherwise, hosts the hardware on US soil so that connections look domestic. Wages from multiple employers flow into US bank accounts opened with stolen identities, then onward to Pyongyang, where authorities say the proceeds help fund sanctioned weapons work.

Nisos reckons hundreds of these farms are quietly running across the country, with single operatives juggling jobs at several companies at once. One person, several full-time salaries, all flowing the same direction.

What standard vetting missed

The awkward bit for employers is that none of the usual safeguards caught this. Background checks cleared the stolen identity without issue. The video interview looked exactly like a video interview. The resume, despite its tells, sailed past automated screening.

It took a fabricated hurricane to break the illusion, which says something about how much weight the hiring process is actually carrying on its own. The people best placed to spot the next one are not the systems doing the screening. They are the interviewers paying close enough attention to notice when an answer arrives a beat too late, or describes weather that never happened.