Amazon has revealed that it has prevented more than 1,800 job applications from suspected North Korean operatives since April 2024, highlighting a sophisticated effort by Pyongyang to infiltrate U.S. companies through remote IT positions. The disclosure underscores growing concerns over North Korea's use of fraudulent employment schemes to generate revenue and circumvent international sanctions.
In a detailed LinkedIn post, Amazon's Chief Security Officer Stephen Schmidt explained that North Korean nationals, often using fake or stolen identities, have been targeting remote IT roles worldwide, with a particular focus on U.S.-based firms. The primary goal, according to Schmidt, is to secure employment, earn salaries, and funnel the wages back to support the regime's weapons programs. Amazon reported a 27% quarter-over-quarter increase in detected DPRK-affiliated applications this year, alongside a nearly one-third overall rise in such attempts over the past year.
Schmidt noted that these operatives frequently collaborate with facilitators managing "laptop farms"—U.S.-based computers remotely controlled from abroad to create the illusion of domestic employment. This tactic helps bypass geographic restrictions and company verification processes. Detection methods at Amazon include AI-powered screening tools combined with human review, identifying red flags such as incorrectly formatted phone numbers (e.g., using "+1" instead of "1" for U.S. numbers), mismatched educational credentials (e.g., claiming degrees from universities that do not offer the listed programs), and hijacked dormant LinkedIn accounts bolstered by leaked credentials.
Despite robust defenses, Schmidt acknowledged that one operative successfully infiltrated Amazon via a third-party contractor, only to be detected through monitoring of unusual keystroke latency—approximately 110 milliseconds of delay indicating remote access from overseas. The individual was promptly removed, with no access to sensitive data.
This issue extends beyond Amazon, with Schmidt warning that similar operations are "likely happening at scale across the industry." U.S. authorities have long tracked these schemes, which violate U.N. and U.S. sanctions by generating illicit revenue for North Korea's weapons of mass destruction and ballistic missile programs.
A prominent related case involved Arizona resident Christina Marie Chapman, sentenced in July 2025 to 102 months (8.5 years) in prison for operating a laptop farm from her home. Chapman's scheme assisted North Korean IT workers in securing remote positions at over 300 U.S. companies, including Fortune 500 firms, generating more than $17 million in revenue—much of which flowed back to Pyongyang. She pleaded guilty to conspiracy to commit wire fraud, aggravated identity theft, and money laundering.
North Korea's cyber operations trace back to the mid-1990s, evolving into a formidable force under Bureau 121, a unit within the Reconnaissance General Bureau estimated to include around 6,000 elite hackers. Many operate from abroad in countries like China, Russia, India, Malaysia, and Belarus to evade detection.
In November 2025, the U.S. Treasury Department imposed sanctions on eight North Korean individuals and two entities for laundering proceeds from cybercrimes and IT worker fraud. Officials stated that DPRK-affiliated cybercriminals stole over $3 billion in the past three years, primarily through cryptocurrency thefts, to fund the regime's nuclear ambitions.
These employment scams complement North Korea's broader cyber strategy, which includes high-profile cryptocurrency heists. In 2025 alone, DPRK-linked hackers stole a record $2 billion in digital assets, contributing to a cumulative haul exceeding $6.75 billion since tracking began.
Experts emphasize that the remote work boom post-COVID has facilitated these infiltrations, allowing operatives to pose as U.S.-based professionals. Additional risks include potential data theft, installation of backdoors, and insider threats once employed.
U.S. agencies, including the FBI, State Department, and Treasury, have issued repeated advisories urging companies to enhance vetting processes—such as requiring in-person interviews where feasible, scrutinizing resumes for inconsistencies, and monitoring for anomalous network behavior.
As global tech hiring remains heavily remote, particularly in AI and machine learning fields, the threat persists. Schmidt encouraged affected organizations to query databases for suspicious patterns and report incidents to authorities, stressing shared responsibility in countering this state-sponsored fraud.
