Skip to main content
Black Friday Sale - Get 40% off Vantage
Published loading...Updated

North Korean operatives running fake job portal targeting US AI firms

North Korean operatives impersonate major U.S. AI and cryptocurrency job platforms to steal intellectual property and fund weapons programs, Validin researchers said.

  • On Thursday, North Korean operatives built a fake job-application platform targeting applicants to major U.S. artificial intelligence and cryptocurrency firms, seeking to steal money and proprietary know‑how for the Kim Jong Un regime.
  • Experts say the scheme fits a broader ecosystem that has seen North Korean hackers steal billions from banks and cryptocurrency firms, with a 2023 White House official linking thefts to half of the missile program.
  • Mimicking a major recruiter site, the attackers copied Lever and posted fictional Claude-related roles at Anthropic, then controlled interview tests to make candidates run malicious tools.
  • Validin found the portal this week and reported it on Thursday, saying no confirmed victims are known yet, while CNN has contacted affected companies impersonated and past reports showed a California-based crypto entrepreneur paid tens of thousands before the FBI notified him.
  • Experts warn the tactic reflects an evolution in Pyongyang tactics as targeting job seekers gives attackers a large advantage, insider-threat researchers say operators hold elevated privileges amid U.S. indictments and sanctions.
Insights by Ground AI

14 Articles

Think freely.Subscribe and get full access to Ground NewsSubscriptions start at $9.99/yearSubscribe

Bias Distribution

  • 83% of the sources are Center
83% Center

Factuality Info Icon

To view factuality data please Upgrade to Premium

Ownership

Info Icon

To view ownership data please Upgrade to Vantage

CNN Brasil broke the news in Brazil on Thursday, November 20, 2025.
Too Big Arrow Icon
Sources are mostly out of (0)

Similar News Topics

News
Feed Dots Icon
For You
Search Icon
Search
Blindspot LogoBlindspotLocal