The job application looked perfect. The candidate had a stellar resume, a polished LinkedIn profile, and a face that matched their video interview perfectly. But the person on the other side of the screen wasn't a developer from Ohio. They were a state-sponsored operative working from a bunker in Pyongyang.

A new report from cybersecurity firm CrowdStrike reveals that North Korean hackers, specifically the group known as "Famous Chollima," accounted for 47 percent of all state-backed, "hands-on-keyboard" intrusions into U.S. tech companies between April 2025 and May 2026. These aren't automated bot attacks. These are human operatives who have successfully embedded themselves into the payrolls of American firms.

The Rise of the 'Fake' Employee

The strategy is as bold as it is effective. By posing as remote IT workers, developers, and coders, North Korean operatives bypass traditional perimeter defenses. They aren't breaking down the digital door; they are being handed the keys by HR departments.

Once hired, these operatives use a sophisticated blend of technology to maintain their cover. They utilize AI-generated deepfakes to spoof faces during video interviews and pair them with high-quality fraudulent identity documents. Because North Korea is heavily sanctioned, these hackers are highly motivated to secure legitimate salaries, which are then funneled directly back to the Kim Jong Un regime to fund its nuclear weapons program.

Beyond the Salary: The Real Objective

While the steady stream of corporate salaries is a significant revenue source, it is merely the baseline. Once inside a company’s network, these operatives pivot to their primary mission: data theft and extortion.

"Hands-on-keyboard" intrusions are particularly dangerous because they involve a human actor actively navigating a system, rather than a script that can be flagged by standard antivirus software. These hackers typically start with stolen credentials and then abuse legitimate administrative tools already present in the system to maintain persistence.

When they find sensitive intellectual property, they don't just steal it. They weaponize it. If a company discovers the breach and attempts to terminate the employee, the hackers often threaten to leak the stolen data unless a ransom is paid. Furthermore, the group specifically targets blockchain developers, aiming to siphon off cryptocurrency to help the regime circumvent the Western banking system. In 2025 alone, North Korea reportedly netted $2 billion in stolen crypto.

What This Means for Tech Companies

The sheer scale of this infiltration suggests that the standard "trust-but-verify" model of remote hiring is effectively broken. Companies are now facing a reality where their own employees may be the primary vector for state-sponsored espionage.

Key Takeaways

  • Human-Led Intrusions: North Korean operatives now account for 47% of all documented human-led cyber intrusions in the U.S. tech sector.
  • The 'Insider' Threat: Hackers are successfully bypassing security by posing as remote workers, using AI deepfakes and stolen identities to pass background checks.
  • Dual-Purpose Attacks: These operatives simultaneously collect corporate salaries to fund the regime while stealing IP and crypto to extort their employers.

As companies move into the second half of 2026, the focus for security teams will shift from external firewalls to internal identity verification. The question for HR and IT departments is no longer just about technical skill, but about how to verify the physical existence of a candidate in a world where a digital identity can be perfectly manufactured. The next round of hiring will likely require far more rigorous, in-person verification steps that many remote-first companies have spent years trying to move away from.