A friend of mine, John D., received this reach-out on Threads (see the two figures below).

At first, he thought it was the standard fake employer scam, but it’s more than that. It’s very, very likely a part of a North Korean fake employee scam.  I’ve written about these North Korean scams that attempt to get remote positions at companies around the world in order to pick up paychecks, steal intellectual property, steal money (or cryptocurrency), and hit the employer up for a ransom when they get discovered.

For more information on fake North Korean employees, see this KnowBe4 whitepaper I wrote: https://www.knowbe4.com/hubfs/North-Korean-Fake-Employees-Are-Everywhere-WP_EN-us.pdf.

In this particular example, a North Korean is trying to recruit a native language speaker in their target country. They give some sob story about not being able to earn enough money in their home country and not being able to get a job in the targeted victim’s home country. The North Korean will get the job interview and do the work, but the contacted person will attend the interviews and participate in team meetings. These days, because of fake employees, most companies require remote employees to get on camera during team meetings. The sender offers to split the gained paychecks 50/50. How nice!

Uh, but it’s illegal in so many different ways. So, don’t get tricked into participating. Law enforcement has arrested many of these participating “mules,” and they get sent to prison, get a felony record, and have to pay back the money plus fines. Definitely not worth it.

The North Korean fake employee program is headed by the leader of North Korean and likely involves many thousands of North Koreans. They operate in distributed teams, often located in Asia, Russia, and other North Korean-friendly countries that are easier to operate in than North Korea (which has frequent power and Internet interruptions).

The North Korean fake employee schemes operate across the criminal spectrum. Some of the North Koreans fake employees use fake identities, many steal and use other people’s identities, and they, too, like in this case, hire real people to be involved using their identities. Sometimes, the North Korean fake employees actually do the work. Sometimes the work is farmed out to other subcontractors. And sometimes they do no work, just trying to collect a few paychecks before they are terminated.

There have been hundreds of people who accepted being the “frontman” or “money mule” from reach-outs like the one above. Most, when arrested, claim they didn’t know they were working for North Korea, but oftentimes their subpoenaed private communications reveal that they did.

Don’t be fooled by a sketchy job deal offering “easy money”. It’s a scam. It’s likely a North Korean fake employee scam.