Microsoft Disrupts North Korean IT Worker Network, Shuts Down 3,000 Fraudulent Email Accounts

Microsoft has disabled over 3,000 Outlook and Hotmail accounts linked to a sophisticated North Korean scheme aimed at infiltrating global tech companies by posing as freelance IT workers.

According to a blog post published by the tech giant, the operation is part of a broader North Korean effort to generate revenue through remote employment. The workers, often posing as South Koreans or other foreign nationals, use advanced AI tools to fake credentials, manipulate images, and conduct job interviews under false identities.

Microsoft’s Threat Intelligence team discovered a public repository in October containing AI-enhanced profile photos, fabricated resumes, email addresses, and playbooks on how to commit identity theft and bypass verification on freelance platforms. Some workers used software like Faceswap to embed their faces into stolen ID documents and make resumes appear more professional. Others used voice-altering tools to pass job interviews.

“These techniques help them mask their identities and evade detection while applying for sensitive roles,” Microsoft said, warning that AI-driven deception could soon allow North Korean operatives to conduct live interviews without facilitators.

The U.S. Department of Justice recently unsealed indictments revealing the scope of the scheme. The FBI searched 29 "laptop farms" in 16 states where Americans allegedly hosted hardware that North Koreans could access remotely. Court filings mention several U.S.-based accomplices, including an active-duty military member with a security clearance.

Cybercrime researcher ZachXBT estimates the operation has earned Pyongyang over $16.5 million in cryptocurrency this year alone, with average monthly earnings per worker ranging between $3,000 and $8,000.

Microsoft continues to monitor and dismantle related infrastructure, urging companies to remain alert to suspicious remote work applicants and unusual account behaviours.