Fake Recruiters, Fake Candidates and Lures by the Hundred: Microsoft Maps How North Korean Hackers Are Scaling Up With AI
Microsoft Threat Intelligence says North Korean hacking groups now use AI across much of their work, from building fake companies and job candidates to mass-producing phishing lures and malware. The tricks are familiar; the speed is new. Here is the briefing and the layers that blunt it.
Here Is How Layered Defenses Keep Up When Attackers Scale With AI
North Korea’s hacking groups have not changed what they want: money for the regime, intelligence, and occasionally disruption. What has changed, according to Microsoft, is how fast they can do it. A new report tracks how far each group has woven AI into its daily work, and the answer is: a long way.
This briefing summarizes Microsoft Threat Intelligence’s report on AI adoption by North Korean threat actors, published October 29.
The adoption scorecard
Microsoft sorts the groups it tracks into four stages. It rates overall adoption as high.
- Operationalized (AI built into routine work): Jade Sleet, Coral Sleet and Jasper Sleet.
- Accelerating (rapid uptake across several functions): Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet.
- Expanding (AI in selected activities): Emerald Sleet.
- Emerging (limited or experimental use): no North Korean group currently assessed here.
What the speed-up looks like
- Fake companies in days: between June 8 and June 12, 2026, Jade Sleet posed as recruiters for a spoofed AI-powered blockchain intelligence company, then ran similar job-themed outreach through two more front companies in the same short window.
- Lures by the batch: Microsoft found more than 100 PDF lures attributed to Onyx Sleet from August and September 2026, with dozens created within minutes of each other, very likely by an AI platform.
- Fake job candidates: Jasper Sleet uses AI to build resumes and personas, apply for remote jobs and keep several fake workers’ communications consistent.
- Synthetic voice and video: Microsoft found possible AI-generated voice and video activity tied to Emerald Sleet.
- Faster malware work: AI coding platforms likely helped several groups write, debug and rework tools. Sapphire Sleet likely used AI in the August 2026 Rust software compromise, and since April 2026 Coral Sleet has been trojanizing private GitHub repositories with a workflow Microsoft believes was built with AI help.
- Agentic tools: since late October 2026, Onyx Sleet and Pearl Sleet have used ARTEX, an open-source agentic AI penetration testing framework.
One important caveat: Microsoft assesses that these operations are still directed by humans and have not become fully autonomous. AI is a force multiplier on old tricks, not a replacement for the operators.
The layers that blunt it
- Hiring checks: require candidates to appear on camera across several video interviews, and treat repeated “camera trouble” as a red flag. Confirm a unique, non-VoIP phone number and a real digital footprint, check whether the same persona is working at other companies, and call references instead of relying on email. Look harder at contractors placed through staffing firms.
- Email and messaging: use link and attachment scanning, and turn on retroactive removal of messages later found to be malicious. Microsoft 365 examples include Safe Links, Safe Attachments and Zero-hour auto purge.
- Sign-in controls: block device code sign-in flows unless there is a specific business need, and require multi-factor authentication everywhere.
- Endpoint protection: run endpoint detection and response in block mode, keep cloud-delivered antivirus protection on, and enable rules that block executable content from email and obfuscated scripts. Microsoft Defender’s attack surface reduction rules are one example.
- Exposure management: patch internet-facing systems quickly, keep them behind a VPN, web application firewall or reverse proxy where possible, and automate updates.
- People: train staff, especially developers and anyone in hiring, to expect polished recruiter outreach, coding “assessments” and investor pitches that are actually lures.
What this means for your company
You do not need to be a crypto exchange to be in the path of these groups. Software developers, IT providers and any business hiring remote technical staff are regular targets. The practical shift is volume and polish: phishing that once had obvious mistakes now reads well, and a fake job applicant can look like a strong candidate. No single tool stops that. What works is stacking ordinary controls, including identity checks in hiring, filtered email, strong sign-in policies, protected endpoints and patched systems, so that a convincing story still runs into a wall.
Hiring remote technical staff, or wondering whether your email and sign-in settings would catch an AI-polished lure? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
