A Virginia security company says it turned a suspicious job candidate into a live counterintelligence case using a fake hiring process and a monitored laptop. The effort traced what it believes is a North Korean remote-work cell tied to a broader scheme that U.S. officials say funnels money to Pyongyang and exposes U.S. companies to theft and extortion.
Nisos, a corporate security and investigations firm, said it grew suspicious after a candidate it called "Jo" stumbled through interviews for an artificial intelligence role, gave shaky answers about his claimed location in Florida, and twice logged off when asked to share his screen.
Instead of rejecting him, the company made what it described as a "bait offer," sent a monitored laptop to a Florida address, and watched as the device was used to coordinate job applications, references, and interviews with what Nisos analysts said appeared to be a network of at least 20 operatives.
The company said its monitoring suggested the workers were linked to a laptop farm in Florida and were likely operating from China while posing as U.S.-based applicants.
Nisos said the network had collectively applied to at least 160,000 jobs and that Jo alone appeared to have applied to about 5,000 over roughly a year. The firm said it alerted the FBI before mailing the laptop and later warned other companies that it believed had hired members of the same network.
The account aligns with recent warnings from federal authorities.
The Justice Department said in June 2025 that North Korean operatives, using stolen or fake identities and aided by people in the U.S. and elsewhere, fraudulently obtained remote jobs at more than 100 U.S. companies, sometimes stealing sensitive military technology or cryptocurrency.
The FBI said in July 2025 that U.S.-based facilitators help provide addresses, internet connections, and remote access to company laptops, allowing the workers to appear domestic.
The crackdown has intensified.
The Justice Department said Christina Chapman of Arizona was sentenced in July 2025 to 102 months in prison for helping North Korean IT workers obtain jobs at more than 300 U.S. companies and generating more than $17 million in illicit revenue.
On March 12, the Treasury Department sanctioned six individuals and two entities tied to North Korean IT worker fraud schemes, saying the operations generated nearly $800 million in 2024 for North Korea's weapons and ballistic missile programs.
North Korea denied wrongdoing. In remarks carried by KCNA, a Foreign Ministry spokesperson called the U.S. case "an absurd smear campaign" and referred to the "nonexistent 'cyber threat' from the DPRK." China also rejected the allegations.
Jim Thomas ✉
Jim Thomas is a writer based in Indiana. He holds a bachelor's degree in Political Science, a law degree from U.I.C. Law School, and has practiced law for more than 20 years.
© 2026 Newsmax. All rights reserved.