North Korean IT Workers Use AI, On-Camera Proxies and Remote Desktop Tools to Pass Technical Interviews

Silent Push links a Discord recruitment scheme run by a persona called 'Tec Guru' to North Korean IT workers who pay on-camera proxies and coach them live via Google Meet, ChatGPT and remote-control tools such as AnyDesk and TeamViewer to defeat identity…

Silent Push assessed with moderate-to-high confidence that a persona known as 'Tec Guru', who recruits on-camera proxies through a 'Mouse Review' Discord advertisement and operates on Discord (tecguru113) and Telegram (@tecguru0618), is a North Korean IT worker. The scheme proposed a revenue split with the hidden worker — described as 65/35 in one report and 35/65 offered to the proxies in the other — with proxies recruited in the US, Europe and Latin America. During Google Meet interviews the proxy stays on camera while the real worker supplies answers via ChatGPT-generated prompts, real-time messaging, or remote-control tools including AnyDesk and TeamViewer (one report also lists Chrome Remote Desktop). The operator recommended Astrill VPN, a service Silent Push previously linked to North Korean threat-actor infrastructure, and used a US-style VoIP number. Successfully placed workers can gain insider access to source code, cloud tenants and CI/CD systems, enabling data theft, extortion, payroll fraud and sanctions exposure for employers; on July 31, 2026, the US, Japan, South Korea and eight other governments issued a joint alert urging stronger identity verification and payment scrutiny.

• Silent Push assessed with moderate-to-high confidence that the 'Tec Guru' persona is a North Korean IT worker.
• On-camera proxies were recruited via a 'Mouse Review' Discord advertisement, targeting the US, Europe and Latin America.
• Revenue split reported inconsistently: 65/35 with the hidden worker (Report 1) vs 35/65 offered to proxies (Report 2); neither source states the allocation between proxy and hidden worker explicitly.
• During Google Meet interviews the hidden worker supplies answers via ChatGPT-generated prompts, real-time messaging, or remote-control tools: AnyDesk and TeamViewer per both reports, plus Chrome Remote Desktop per Report 1 only.
• The operator recommended Astrill VPN, previously linked by Silent Push to North Korean threat-actor infrastructure.
• IoCs: Discord account tecguru113, Telegram handle @tecguru0618, and a US-style VoIP number.
• Placed workers could access source code, cloud tenants and CI/CD systems; risks include insider access, data theft, extortion, payroll fraud and sanctions exposure.
• A July 31, 2026 joint alert from the US, Japan, South Korea and eight other governments urged stronger identity verification and payment scrutiny.