Researching Employment Scams
Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.
The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.
- Fake remote employees can persist for years while exfiltrating data or stealing funds
- Controlled sandbox environments were used to observe suspected DPRK IT workers
- Background checks and ongoing verification urged for remote hires
- Commenters note reciprocal scams exploiting job seekers via MLM-style schemes
Full article302 words · extracted from schneier.com · click to collapse
Comments
C'est Moi • September 3, 2026 9:16 AM
Do those “researchers” glow?
Axing 4 a friend. Thanks.
1st post kitty – ya looo-hoo-hoo-suh-huh-her!
Rontea • September 3, 2026 10:25 AM
Impressive and sobering work. This underscores the critical need for rigorous background checks, ongoing verification for remote employees, and vigilance in monitoring for signs of insider threats. Once embedded, these operatives can operate for months or even years, blending into the workforce while exfiltrating sensitive data or positioning themselves for financial theft.
The team’s creative use of controlled sandbox environments shows how deep visibility and proactive investigation can disrupt these operations before real damage is done. Great reminder that in cybersecurity, always doubting and verifying is not paranoia—it’s essential defense.
KC • September 3, 2026 8:54 PM
re: A Good Sandbox Story
Angelo Espree was hired on to develop smart contracts for a DeFi project. The project had ~money~ with commas.
Two other – how can I say this – DPRK IT workers were brought on to help as well.
No matter that Angelo said he lived in TX, had a CA driver’s license, and a bank account in NY. The team was needed to integrate whale crypto wallets and legitimize the ecosystem.
On day one Angelo synced his Google account on a virtual desktop in the sandbox. And the ‘days went by with the Chollimas prancing all over the stable’.
Mike • September 3, 2026 11:56 PM
There’s a lot going around about it going the other way too. Too many people desperate for work. Not enough jobs. And the “employment opportunities” prey on them. For example: Interviews spent doing door-to-door sales. Not to mention high-pressure MLM scams.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.schneier.com/blog/archives/2026/09/researching-employment-scams.html