Threats · 5h ago
Material Security counted 27 suspected North Korean IT-worker personas reaching onboarding at monitored companies over one year, including four in the latest 30-day period. Onboarding ranged from offer letters and background checks to equipment requests or first-day IT setup.
These applicants used fabricated identities and reusable personas to pursue remote jobs, sometimes at several companies at once: 18 of the 27 were also in process elsewhere. If one received a company account, broad internal sharing could make sensitive files available without extra privileges. At one firm, about 277,000 files containing Social Security numbers were shared company-wide or by public link.
Material Security reported potential exposure, not confirmed file access. For companies with broadly shared files, a hiring-screening miss can therefore become a data-access risk as soon as an account is provisioned—and the actual reach remains uncertain until access is established.
1 source covering this story
Suspected North Korean IT workers reached onboarding at companies with open data - Help Net Security
Material Security found fake North Korean IT workers reaching onboarding at some firms where sensitive files sat open to any new account.
Part of the PlainSec briefing for 2026-11-13