North Korean IT Workers Caught in Fake Crypto Startup Sting

Security researchers from BCA LTD, NorthScan, and ANY.RUN ran a deliberate insider-threat experiment in 2026, posing as a cryptocurrency startup called Ballena Azul and recruiting what they believe were three North Korean IT operatives. Each candidate arrived through the standard hiring pipeline: recruiter outreach on GitHub, a referral chain, a remote interview, a signed contract, and an issued work VM. Once access was granted, the researchers observed every move. The trio immediately ran dxdiag, systeminfo, and wmic to fingerprint their machines, then geolocated their connections to verify VPN or proxy usage. One operative installed Chrome Remote Desktop and synced a personal Google account onto the sandbox VM, exposing saved passwords, browser history, and installed extensions before logging into GitHub on the same host.

Identity verification proved the most damning signal. The first hire claimed Pasadena, Texas, but supplied a California driver's license and a New York bank account; image metadata traced the ID through Google Gemini, and Google later confirmed a SynthID watermark, the invisible marker embedded in AI-generated or edited images. The second candidate provided a Texas license, a real Social Security number, and a Kansas City bank account. The third submitted a New York license belonging to another person alongside a genuine iPhone 15 photograph with GPS coordinates stripped. A July 31 joint advisory from the FBI and partner agencies reiterates that North Korean IT workers seek contracts specifically to remit salaries to state agencies, and lists forged or altered documents among the recruitment red flags. An April Justice Department sentencing of two US facilitators in a parallel scheme tied more than 100 companies, 80 stolen identities, and over $5 million in revenue to Pyongyang.

Defenders should treat North Korean placement as both an APT tradecraft concern and an authentication problem. Hiring teams can use the onboarding artifacts themselves: image metadata, SynthID checks via Gemini, geolocation consistency between stated address, ID, and bank account, and reverse-image searches on government IDs. Operators should also harden issued VMs against the reconnaissance stage the researchers documented, because the moment a placement is approved, the worker's access is expected, monitored only by trust rather than policy. A negative SynthID result does not clear an image, since the marker only covers content touched by Google's models. For individuals concerned about exposed credentials from similar insider attacks, running a password checker against breached corpora is a useful baseline, while a browser fingerprint test can show what a synced personal profile leaks to the sandbox. A broader privacy checkup helps employees understand what their browsers and remote tooling expose when handed an unsanitized workstation.