The Remote Hire Who Aced Your Test May Not Be Who They Say. 6 Checks Before You Sign. | Edition 359

You post a remote contract role. One applicant has a tidy résumé, a professional profile that matches it, a strong coding test and smooth interview answers. A new report from Microsoft Threat Intelligence shows AI can now help fake applicants produce every one of those.

The report, published October 29, tracks how North Korean government-backed groups use AI. One group Microsoft calls Jasper Sleet “uses fraudulent identities to obtain legitimate remote employment.” In plain terms: real paychecks from real companies, earned under someone else’s name.

Microsoft’s own hiring advice names staffing companies as “the easiest avenue for North Korean workers to infiltrate target companies.” If you bring on remote contractors through an agency, that door is open to you too.

What the report found

Microsoft sorts North Korean groups into four stages of AI adoption: emerging, expanding, accelerating and operationalized. Jasper Sleet sits in the top stage, alongside two other groups that Microsoft says “have operationalized AI across their entire operations.” That means AI is a routine part of how they work, not an experiment.

Microsoft lists what four North Korean groups, Jasper Sleet among them, use AI to do. The parts that matter for hiring include:

• “Build resumes, biographies, and realistic interview responses”
• “Support coding assessments, job-related tasks, and the management of multiple worker personas”
• “Alter profile images, video, voice, and backgrounds”

Microsoft says Jasper Sleet’s suspected use of AI-assisted résumé workflows shows “an improvement in the speed, scale, and relevance of persona preparation over the past year.” Microsoft says its AI tooling also “helps maintain consistent communication and performance across multiple fraudulent worker personas.” One operator can look like several steady, responsive contractors.

One honest limit: Microsoft says these AI-enabled operations “remain human-directed and have not become fully autonomous.” There are still people behind the screen. AI just makes each of them faster and more convincing.

Why a small business should care

The FBI’s October 13 public service announcement on North Korean IT workers fills in what happens after the hire. It says these workers “almost always exfiltrate data,” meaning company information leaves your control, since most are required to record their screens. It also says they pay Americans for a widening range of services, including to “appear on camera, participate in job interviews or meetings,” and pay freelancers “to conduct interviews on their behalf.” Some hand the actual work to other freelancers.

So the person in your video interview may not be the person doing the job, and the person doing the job may not be the name on the contract. A staffing firm sits between you and both of them.

6 checks before you sign

These six checks are built on Microsoft’s “vetting potential employees” guidance, grouped into steps a non-technical owner can run. Where we add a tip of our own, we say so.

1. Give agency contractors extra scrutiny. Microsoft says to apply “greater scrutiny” to staffing-company workers. Our tip: ask the firm in writing what identity checks it ran, then run the checks below yourself anyway.
2. See them on camera, more than once. Microsoft says to make sure the person is “seen on camera during multiple video telecommunication sessions.” If camera or microphone problems keep them from taking part, Microsoft says “this should be considered a red flag.” Make sure the face in week one matches the face in the interview.
3. Make the paperwork line up. Check the résumé and background check “for consistency of names, addresses, and dates.” Small mismatches are worth a polite question.
4. Call the references. Microsoft suggests reaching references by phone or video call “rather than email only.” An email reference is easy to fake.
5. Confirm a real-world footprint. Microsoft lists “a real phone number (not VOIP), a residential address, and social media accounts.” It also says to check that the person’s phone number isn’t shared with other profiles, and that their professional accounts are “not highly similar to the accounts of other individuals.”
6. Look for a second job under the same identity. Microsoft says to search whether a candidate “is employed at multiple companies using the same persona.” A quick search of their name, photo and profile can turn this up.

Three signs after they start

Checks at the door aren’t the end. The FBI lists behaviors it sees once these workers are inside:

• Remote-control tools on the work laptop. The FBI says they “continue to use remote desktop software” and also plug in small remote-control gadgets it names, such as TinyPilot, PiKVM and GL.iNet. That’s how someone overseas runs a laptop that sits in someone else’s house.
• Apps that have nothing to do with the job. The FBI says they “frequently download applications outside of, or unconnected to their job role.”
• Payment and contact details that keep changing. The FBI says they “tend to rotate through bank accounts, street addresses, social media accounts or other identifiers” at an unusually high rate.

Our advice: if you ship a laptop, ship it only to the address on the background check, and give contractors only the access their job needs.

Don’t overcorrect

The FBI is blunt that these workers “cannot be identified reliably with a single indicator,” and that aggressive controls carry “unusually high risks of generating false positives that could harm legitimate employees.” Plenty of honest contractors have a glitchy webcam or a short online history.

Our advice: run the same checks on every remote hire, treat any one odd answer as a reason to ask, not to accuse, and never treat an accent, a name or a country as a warning sign. Asking for a U.S. passport, several forms of ID or live identity verification can “raise friction,” the FBI says, but it also says these workers use stolen identities, so paperwork alone won’t settle it.

The bigger picture

Microsoft rates North Korean groups’ overall AI adoption “as high,” and the report shows how much faster AI lets them move. Another group, Jade Sleet, “launched campaigns through three front companies in a single week” in June 2026, posing as recruiters with software engineer job offers. A third, Onyx Sleet, made over 100 PDF lure files in August and September 2026 for phishing campaigns against South Korean users. Their metadata showed dozens created within minutes, which Microsoft calls “highly likely to be the output of an AI platform.”

Those campaigns hook individual people with fake job offers and lures rather than applying for jobs, but the lesson is the same: a polished, fast, perfectly tailored message is no longer proof that a careful human wrote it.

If you think you’ve hired one of these workers, the FBI asks you to file a complaint at ic3.gov.

Bottom line

AI has made a fake remote applicant look as polished as a real one, and Microsoft says staffing firms are the easiest door in. You can’t out-read a perfect résumé, but you can make a fake identity work hard: see the person on camera more than once, call references live, confirm a real phone and address, and look for the same identity working somewhere else. Run those checks on everyone, the same way, before you sign.