Deceptive Employment Scheme: AI-assisted hiring deception

This case study was originally published in OpenAI’s February 2025⁠(opens in a new window) report.

Actor

We banned a number of accounts that were potentially used to facilitate a deceptive employment scheme. The activity we observed is consistent with the tactics, techniques, and procedures (TTPs) Microsoft⁠(opens in a new window) and Google⁠(opens in a new window) attributed to an IT worker scheme potentially connected to North Korea.

While we cannot determine the locations or nationalities of the actors, the activity we disrupted shared characteristics publicly reported⁠(opens in a new window) in relation to North Korean state efforts to funnel income through deceptive hiring schemes, where individuals fraudulently obtain positions at Western companies to support the regime’s financial network.

Behavior

The various accounts used our models to generate content seemingly targeting each step of the recruitment process with different deceptive practices, all designed to be mutually supporting.

The actors used virtual private networks (VPNs), remote access tools such as AnyDesk, and voice over IP (VOIP) phones largely appearing to be located in the United States. While our visibility into the ways these actors distributed their content is limited, we identified content posted to LinkedIn.

Completions

One main set of content generated by these actors consisted of personal documentation for the fictitious “job applicants,” such as resumés, online job profiles, and cover letters. These resumés and profiles were frequently tailored to a specific job listing to increase the chances of appearing as a well-qualified candidate. A second set consisted of creating “support” personas, which were used to provide reference checks for the “job applicants” and refer them for employment opportunities.

Impact

Given our visibility into only a small portion of this overall set of activity, assessing its impact would require inputs from multiple stakeholders.