DOJ raided more than 40 Texas residences on September 21-25 and seized 187 laptops and other devices it says North Koreans used in an IT-worker scheme. The FBI says the workers now also hire freelancers in South Asia and West Africa, so US hosts are one intermediary among several.
Perspective Coverage
17 publishers
- Builder
- Builder 25%
- Operator
- Operator 55%
- Investor
- Investor 20%
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+25
- Incentives55
- Confidence78
buildConfirmed5 publishers The Justice Department searched more than 40 Texas laptop farms serving North Korean IT workers and seized over 180 company-shipped computers. Prosecutors count at least 70 victim companies. For employers, the shipping address is now a control point.
Perspective Coverage
6 publishers
- Builder
- Builder 13%
- Operator
- Operator 58%
- Investor
- Investor 29%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence72
North Korean fake IT workers are submitting up to 60 applications a day, and experts urge in-person verification of contractors
North Korean fake IT workers are submitting as many as 60 job applications a day, ITPro reported from new research. Interviews are where these candidates succeed, so identity checks at hiring belong on the security team's list.
Reality
- Evidence55
- Adoption35
- Hype gap+15
- Incentives50
- Confidence50
A ReversingLabs author traces this year's AI agent incidents to package registries
A ReversingLabs author argues in CyberScoop that nearly all of this year's AI agent incidents ran through a package registry, dependency or model file. The cases are named and dated, but "nearly all" is the author's own judgment.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+30
- Incentives80
- Confidence55
North Korea moves its fraudulent-hire scheme into sales, marketing and medical roles
Huntress found suspected DPRK workers inside an Australian healthcare company and a sales hire wearing a stolen identity, which puts the screening that catches them in the hands of recruiters and background-check vendors.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence50
Huntress confirms five DPRK-aligned workers cleared hiring and onboarding in 2026
Recruiting and document review own this intrusion path, because the hire really does the job. Huntress found its five 2026 cases in passport photo metadata and in a PiKVM turning up on a new starter's laptop.
Reality
- Evidence55
- Adoption35
- Hype gap+15
- Incentives70
- Confidence55
North Korea's hiring funnel: 60 applications a day, 22 personas, ten jobs landed
Recorded Future says one PurpleDelta cluster applied at more than 1,100 companies and was likely employed at ten or more. The control point is the recruiting funnel, not the SOC.
Reality
- Evidence64
- Adoption55
- Hype gap+12
- Incentives72
- Confidence56