North Korea's fake IT worker scheme takes dangerous turn as new threats emerge every day

What began as a scheme to generate cash for North Korea by deploying fake IT workers at American companies has now turned into an opportunity to collect intelligence from high-value targets, cybersecurity researchers warn.

New details are emerging of the sprawling spy operation within U.S. borders, with cybersecurity tech company CrowdStrike claiming it is finding one or two suspected North Korea IT worker cases every day.

The scheme is creating a heightened espionage foothold inside American companies spanning multiple industries. And CrowdStrike claims it has seen remote IT workers hand off access to malware teams when North Korea identifies intelligence worth collecting. And federal cases show overseas workers gaining access to sensitive U.S. military technology.

"They don't discriminate," Adam Meyers, CrowdStrike's head of counter adversary operations, told Fox News Digital, explaining that the workers apply broadly across industries, from consumer companies to defense contractors.

CHINA-LINKED HACKERS INFILTRATED US GOVERNMENT NETWORKS BEFORE FBI TAKEDOWN

But when they land inside a "particularly juicy target," Meyers said, CrowdStrike has seen the operation handed off to a malware team "because they realize that there's some intelligence value and something that they want to collect."

Meyers did not say whether the malware teams successfully collected sensitive information after those handoffs.

The FBI is now warning that the scheme poses a "significant national security and intellectual property theft insider threat."

North Korean workers are targeting cleared defense contractors, jobs that require U.S. government security clearances, and even active-duty military personnel who can host company laptops.

Recent federal cases illustrate the stakes, from a worker who successfully accessed controlled technical information at an AI defense contractor to impostors who secured offers for jobs involving military AI and Top Secret intelligence.

In one case involving a network of U.S.-based "laptop farms" that helped overseas workers obtain remote jobs at more than 100 American companies, prosecutors identified a California defense contractor developing AI-powered equipment and technologies.

An overseas worker using a stolen American identity was hired as a full-time remote software engineer in January 2024, according to the indictment.

Instead of going to the purported employee, the company laptop was shipped to a conspirator in New Jersey and ultimately transferred to a laptop farm, where software allowed the overseas worker to operate it remotely.

For more than two months, prosecutors said, the worker accessed the contractor's systems and downloaded technical data, including material controlled under the International Traffic in Arms Regulations, or ITAR. The indictment said documents obtained from victim companies included information related to "sensitive U.S. military technology."

The same contractor hired two other overseas workers using stolen American identities within roughly six weeks, prosecutors said. Their laptops were also routed through U.S.-based facilitators for remote access.

A separate case unsealed last week shows operatives pursuing positions with even more explicit national security ties.

Overseas conspirators were allowed to use the identity of a Virginia man who worked for a cleared defense contractor and held an active top secret security clearance.

One impostor secured a $130,000 software engineering offer at a government contractor working on a generative AI project for a component of the U.S. military. The comp