source_4031.pdf (5 MB)

A DPRK-affiliated IT worker cell used female callers alongside developers to obtain remote technology jobs under fabricated identities. The operation generated more than 1,200 female personas, used stolen U.S. identity data, isolated accounts through ixBrowser and proxies, and produced resumes and interview scripts with AI tools. MageHire allegedly served as the cell’s U.S. front, with its chief executive managing clients, authentication, placements, and damage control after an unqualified operative failed an interview. The researcher assessed both the cell’s DPRK affiliation and the facilitator’s knowing involvement with high confidence.