A suspected North Korean IT operative applied for a Lead AI Architect role at a U.S. cybersecurity firm by stealing the identity of a Florida resident and submitting an AI-generated resume that mirrored the job description.

The applicant used a VoIP phone number, VPN-linked IP addresses, and inconsistent online profiles during the June 2025 hiring process. During a virtual interview, suspicious behavior-including looking away from the camera, consulting another screen, and abruptly ending the call when asked to share it-raised red flags for Nisos analysts conducting OSINT checks.

Investigators discovered the scheme was part of North Korea's broader effort to place remote workers in tech firms to funnel wages back to the regime for weapons programs. The attempt was thwarted before hiring, prompting coordination with law enforcement.