GoKawiilNisos 'hires' suspected North Korean IT worker to expose fraud network
Security firm Nisos ran a sting on a suspected North Korean operative who applied for a remote AI engineering job, sending a surveilled laptop to a US 'laptop farm' in Florida. Over subsequent months Nisos tracked the operator communicating with 22 others and four US-based facilitators while connecting from near the North Korea-China border. A joint advisory from US, Japan, Australia and Germany law enforcement says the broader campaign, called WaterPlum or Contagious Interview, has infected over 30,000 devices in 100+ countries and drained more than 7,000 crypto wallets.
GoKawiil's interpretation of the reporting above, not reported fact.
The case suggests that fraudulent remote-hiring schemes tied to North Korea have scaled into an organized, multinational operation that funds the regime through infiltrated payroll and stolen credentials. Nisos CEO Ryan LaSalle's account implies that standard HR vetting is failing to catch these operators, which could push companies to add stronger verification and monitoring into hiring pipelines. The multi-country advisory indicates governments now view this as a widespread threat requiring coordinated response rather than an isolated incident.
- Nisos ran a covert sting, 'hiring' a suspected North Korean operative and shipping a surveilled laptop to a US facility.
- A joint advisory says the WaterPlum/Contagious Interview campaign has hit 30,000+ devices across 100+ countries and over 7,000 crypto wallets.
- The scheme relies on networks of US-based facilitators and laptop farms to disguise operators' true location near North Korea's border.
Yubico YubiKey 5 NFC Security Key — Hardware-backed identity verification is a strong defense against fake remote hires and credential fraud like the North Korean IT worker scam described in the article. A YubiKey adds a physical authentication layer that's much harder for fraudulent operators to bypass than passwords alone, making it a smart addition to any revamped HR onboarding and access-control process.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Robert Lemos, 2026-09-25
Published there as: “Stopping IT Worker Scams Requires Revamped HR Process”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.