OpenAI banned accounts potentially used to facilitate a deceptive employment scheme, as detailed in a February 2025 report. This activity aligns with tactics, techniques, and procedures (TTPs) that Microsoft and Google attributed to an IT worker scheme potentially connected to North Korea. A June 2025 report from OpenAI further detailed the disruption of additional accounts linked to suspected deceptive employment campaigns, which also used AI to develop materials for potentially fraudulent remote job applications.
Key Points
- OpenAI banned accounts involved in a deceptive employment scheme, as reported in February 2025.
- The observed activity is consistent with TTPs attributed by Microsoft and Google to a North Korea-linked IT worker scheme.
- Actors used OpenAI models to generate content for each step of the recruitment process, including resumes, online job profiles, and cover letters.
- AI models were used to create "support" personas for reference checks and job referrals.
- Actors also crafted social media posts to recruit individuals to support their schemes, such as hosting laptops or lending identities.
- "Job applicant" personas used models during interviews to generate responses to technical and behavioral questions.
- After gaining employment, models were used for job-related tasks like writing code, troubleshooting, and messaging, and to devise cover stories for unusual behaviors.
- A June 2025 report noted that core operators attempted automated resume creation and sought information on tools to manage job applications.
- The June 2025 report also indicated that core operators used ChatGPT as a research tool for remote-work setups and to generate text for recruiting individuals to receive company laptops.
- Threat actors researched tools like Tailscale, OBS Studio, vdo.ninja, and HDMI capture loops to circumvent corporate security.
- Possible contractor operators used ChatGPT to complete job application tasks and generate messages about payments and personas.
Context
According to OpenAI's February 2025 report, the activity shared characteristics with publicly reported North Korean state efforts to funnel income through deceptive hiring schemes. Individuals fraudulently obtain positions at Western companies to support the regime's financial network. The June 2025 report noted that some actors linked to these campaigns may have been employed as contractors by the core group of potential DPRK-linked threat actors, operating within the US.
Why It Matters
This activity highlights the use of AI models in sophisticated deceptive operations, impacting hiring processes and potentially enabling state-sponsored financial networks. It underscores the need for vigilance in detecting AI-generated fraudulent content and practices.
What To Do
- Note that OpenAI's policies strictly prohibit the use of its tools for fraud or scams.
- Watch for patterns of AI-generated content in resumes, cover letters, and interview responses.
- Compare hiring process anomalies with the tactics described, such as unusual VPN usage or remote access tools.
- Review the February 2025 and June 2025 reports from OpenAI for detailed insights into these deceptive schemes.
Keep Exploring
/atlas/claude-family /atlas/gpt-family /techniques/role-objective /techniques/constraints /techniques/output-schema /techniques/ask-before-inventing /techniques/multishot /techniques/xml-delimiting /techniques/system-user-separation /techniques/ptcf /studio?pack=foundation