North Korean IT Workers Recruit Foreign Proxies to Fake Job Interviews and Bypass Hiring Checks
Brief
Cybersecurity researchers at Silent Push have uncovered a suspected North Korean IT worker operation that recruits foreign nationals to act as job-interview proxies.
The scheme uses people in the United States, Europe, and Latin America to appear on camera, pass identity checks, receive payments, and hide the real worker’s location.
The activity was discovered through a suspicious job advertisement posted in the “Mouse Review” Discord server. The account, identified as “tecguru113,” promoted an offer seeking individuals who could become the public face of an IT job candidate.
Silent Push researchers contacted the linked Telegram account , “Tecguru0618,” using a controlled persona to investigate the offer.
The operator, known as “Tec Guru,” allegedly offered a revenue-sharing arrangement. The foreign proxy would receive 35% of the income, while 65% would go to the hidden worker.