Printed from Production AI Institute public record

https://www.productionai.institute/graph/events/evt-aiid-1118

Production AI Institute · Public recordRecord
Production AI Institute
Briefing
Briefing

Today's public AI briefing: what changed, what went wrong, and what the evidence says.

Open Briefing →
Today's AI briefingThe daily record of what changed and broke.Public record explorerSearch every incident, entity, and source.
Check
Check

Inspect tools, incidents, and data-use disclosures against the public record.

Open Check →
Check an AI toolWhat a tool actually does with your data.Run exposure checkTest your own stack against the record.Data-use indexDisclosures across the major AI tools.Incident registryDocumented production AI failures.
The Lab
The Lab

Independent research instruments: model and agent scorecards, moral-reasoning evals, and ecosystem assessments.

Open The Lab →
The LabHow frontier models and agents actually perform.AI Morality CompassTest models on hard moral cases.Agent readinessIs the agent ecosystem production-ready?Ecosystem assessmentsIndependent reviews of the AI stack.Model & agent evalsOpen evaluations and their results.Research libraryEvidence-led analysis and briefings.
Learn
Learn

The open standard, the tools built on it, and the research that interprets the record.

Open Learn →
The FrameworkThe open production safety framework, explained.AI Adoption GuideFive stages from gated access to safe autonomy.Production AI Deployment GuideBuild a governed production system on Microsoft or AWS.Five-Year Automation RoadmapSequence enterprise capability, controls, and value.WorkflowOS · open sourceBuild governed AI workflows.Workflow libraryReady-made governed workflows.InsightsResearch articles on the record.
Act
Act

Turn uncertainty into public evidence: ask, disclose, build evidence, or correct.

Open Act →
Ask for disclosureRequest a public data-use answer.Submit a correctionFlag something wrong or missing on the record.Save a watchTell PAI what to keep current for you.
Method
Method

How the public record is made, governed, corrected, cited, and kept independent.

Open Method →
How records are madeSourcing, review, and correction.
Check an AI tool
Record
Record
Check an AI tool
Production AI Institute public record · AI Incident Database: Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers · observed 2025-11-24
← Back to the public record explorer
incident event
Production AI public record - EditorialMethod →

AI Incident Database: Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers

North Korean operatives have reportedly used AI-generated identities to secure remote jobs or impersonate employers in order to infiltrate companies. These tactics allegedly support sanctions evasion through wage theft, credential exfiltration, and malware deployment. Workers reportedly use fake resumes, VPNs, and face-altering tools; some deploy malware like OtterCookie after embedding, while others lure targets via spoofed job interviews. AI systems are reportedly used to …

AI Incident Database · Incident 1118

Operator lens (medium): inspect D1 (input boundary), D2 (output validation), D7 (tool permissions).

Confidence
82%
Sources
3
Entities
59
Detected
detected 235d ago

Event summary

North Korean operatives have reportedly used AI-generated identities to secure remote jobs or impersonate employers in order to infiltrate companies. These tactics allegedly support sanctions evasion through wage theft, credential exfiltration, and malware deployment. Workers reportedly use fake resumes, VPNs, and face-altering tools; some deploy malware like OtterCookie after embedding, while others lure targets via spoofed job interviews. AI systems are reportedly used to …

D1D2D7D8

Linked entities

  • OpenAI

    vendor | 70%

  • deepfake-technology-developers

    organisation | 70%

  • large-language-model-developers

    organisation | 70%

  • yang-di

    organisation | 70%

  • waterplum

    organisation | 70%

  • wagemole

    organisation | 70%

  • void-dokkaebi

    organisation | 70%

  • unc5267

    organisation | 70%

  • son-un-chol

    organisation | 70%

  • sok-kwang-hyok

    organisation | 70%

  • sim-hyon-sop

    organisation | 70%

  • rim-un-chol

    organisation | 70%

  • ri-kyong-sik

    organisation | 70%

  • reconnaissance-general-bureau

    organisation | 70%

  • purplebravo

    organisation | 70%

  • north-korean-threat-actors

    organisation | 70%

  • minh-phuong-ngoc-vong

    organisation | 70%

  • matthew-isaac-knoot

    organisation | 70%

  • lazarus-group

    organisation | 70%

  • ko-chung-sok

    organisation | 70%

  • kim-ye-won

    organisation | 70%

  • kim-sang-man

    organisation | 70%

  • kim-ryu-song

    organisation | 70%

  • kim-mu-rim

    organisation | 70%

  • jong-song-hwa

    organisation | 70%

  • jong-kyong-chol

    organisation | 70%

  • jang-chol-myong

    organisation | 70%

  • hyon-chol-song

    organisation | 70%

  • gwisin-gang

    organisation | 70%

  • government-of-north-korea

    organisation | 70%

  • famous-chollima

    organisation | 70%

  • department-53

    organisation | 70%

  • contagious-interview

    organisation | 70%

  • christina-chapman

    organisation | 70%

  • choe-jong-yong

    organisation | 70%

  • cho-chung-pom

    organisation | 70%

  • western-companies

    organisation | 70%

  • web3

    organisation | 70%

  • ssa

    organisation | 70%

  • social-security-administration

    organisation | 70%

  • recruitment-teams

    organisation | 70%

  • oleksandr-didenko

    organisation | 70%

  • national-security-and-intelligence-stakeholders

    organisation | 70%

  • macos-users

    organisation | 70%

  • jiho-han

    organisation | 70%

  • irs

    organisation | 70%

  • interviewees

    organisation | 70%

  • internal-revenue-service

    organisation | 70%

  • human-resources-staff

    organisation | 70%

  • hiring-managers

    organisation | 70%

  • haoran-xu

    organisation | 70%

  • epistemic-integrity

    organisation | 70%

  • employers

    organisation | 70%

  • developers

    organisation | 70%

  • cryptocurrency-platforms

    organisation | 70%

  • companies-in-the-united-states

    organisation | 70%

  • chunji-jin

    organisation | 70%

  • blockchain-projects

    organisation | 70%

  • andrew-m.

    organisation | 70%

Related graph edges

EdgeTypeConfidence
ent-vendor-openai to ent-psf-d1maps to60%
ent-vendor-openai to ent-psf-d1maps to60%
ent-vendor-openai to ent-psf-d1maps to60%
ent-vendor-openai to ent-psf-d2maps to60%
ent-vendor-openai to ent-psf-d2maps to60%
ent-vendor-openai to ent-psf-d2maps to60%
ent-vendor-openai to ent-psf-d6maps to60%
ent-vendor-openai to ent-psf-d6maps to60%
ent-vendor-openai to ent-psf-d6maps to60%
ent-aiid-deepfake-technology-developers to ent-psf-d2maps to60%
ent-aiid-deepfake-technology-developers to ent-psf-d2maps to60%
ent-aiid-deepfake-technology-developers to ent-psf-d2maps to60%

Explore the graph

See this record in the relationship map alongside the entities, sources, and controls it connects to.

Open the public record explorer →

Event dates

  • Happened 1 Jan 2021

  • Detected 24 Nov 2025

Sources

  • AI Incident Database - Incident 1118

    secondary | checked 9 July 2026

    Open source
  • Publication of North Korea Information Technology Workers Advisory

    secondary | checked 25 June 2025

    Open source
  • Two North Korean Nationals and Three Facilitators Indicted for Multi-Year Fraudulent Remote Information Technology Work…

    secondary | checked 25 June 2025

    Open source
Cite this record

"AI Incident Database: Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers." https://www.productionai.institute/graph/events/evt-aiid-1118 (observed 2021-01-01; retrieved 2026-07-17). PAI.

Share on XShare on LinkedInCitation guide →
Public record

This record is maintained by PAI and free to cite. If something is wrong or missing, tell us. Corrections and source suggestions keep the record honest.

Share the record
Share on XShare on LinkedIn
Follow policy changes ->Save a watch ->Submit a correction
Records are free to cite. citation guidance.
PAI
Production AI Institute

The public record and operating memory for production AI: what changed, what broke, and what the evidence says.

WorkflowOS · open source (MIT)
Navigate
Briefing
OverviewToday's AI briefingPublic record explorer
Check
Check an AI toolRun exposure checkData-use indexIncident registry
The Lab
The LabAI Morality CompassAgent readinessEcosystem assessmentsModel & agent evalsResearch library
Learn
The FrameworkAI Adoption GuideProduction AI Deployment GuideFive-Year Automation RoadmapWorkflowOS · open sourceWorkflow libraryInsights
Act
Ask for disclosureSubmit a correctionSave a watch
Method & trust
How records are madeCorrectionsHow to citeContact
© 2026 Production AI Institute · CC BY 4.0
AboutPrivacyTermsSecurityGovernanceIndependence