North Korean hackers are now using AI as a normal part of their work. That is the main finding of a new Microsoft Threat Intelligence report, published on October 29, 2026. It tracks eight North Korea-linked groups. AI now helps them run fake job offers, fake job applicants and malware projects faster than before.

I'm Nitin, and I handle hiring and delivery for remote dev teams. This report hit close to home. Many of the tricks it describes are aimed straight at software companies, recruiters and agencies like ours.

Microsoft Security Blog feature image for its report on AI use by North Korean hackers — Image credit: Microsoft Security Blog, from the report Tracking AI adoption in North Korean threat actor tradecraft.

What Microsoft Found About North Korean Hackers and AI

Microsoft rates overall AI adoption across these groups as high. The company says AI works as a force multiplier. It helps the attackers do the same old jobs at more speed and bigger scale.

The goals have not changed. Per the Microsoft Threat Intelligence report, these groups mainly want three things:

Money for the regime, often through crypto and finance targets.
Strategic intelligence from government, defense and policy groups.
Disruption in some politically driven cases.

Here is the part agencies should note. Microsoft lists information technology companies and software supply chains among the usual targets, along with education and government.

One more point keeps this grounded. Microsoft says these AI-enabled operations are still directed by humans. They are not fully autonomous. So this is not a robot army. It is the same playbook, run faster.

The Four Stages of AI Adoption

Microsoft sorted the groups into four stages. Each stage shows how deeply AI sits inside their daily work.

Operationalized: Jade Sleet, Coral Sleet and Jasper Sleet. AI is part of all their routine workflows.
Accelerating: Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet. They are adding AI quickly across many tasks.
Expanding: Emerald Sleet. It uses AI in some workflows, but not across the board yet.
Emerging: No group. Microsoft did not place any North Korean actor at this early, experimental stage.

That last point matters. Not a single tracked group is still just testing AI. Every one of them is past the trial phase.

Microsoft diagram showing four stages of AI adoption among North Korean hackers, with Jade Sleet, Coral Sleet and Jasper Sleet at the operationalized stage — Stages of AI adoption among North Korean threat actors. Image credit: Microsoft Threat Intelligence.

How North Korean Hackers Use AI, Step by Step

The report splits AI use into four areas. I'll keep each one short and stick to what Microsoft actually observed.

1. Research on targets

The groups use AI to study companies, staff, job roles and tech stacks. Then they build lures, fake websites and job applications that fit each target.

A clear example: between June 8 and June 12, 2026, Jade Sleet posed as recruiters for a fake AI-powered blockchain intelligence company. It offered software engineer roles and set up interviews. In the same short window, it ran similar outreach through two more front companies.

Microsoft also saw Diamond Sleet return to the oil and gas sector from August 2026, for the first time since 2023. It built fake telecom companies, with websites and personas, to approach telecom firms as "partners."

2. Fake people and fake job applicants

This is the section every hiring manager should read twice. Microsoft says the groups use AI to:

Write tailored phishing, recruiter and investment messages.
Build resumes, bios and realistic interview answers.
Help with coding tests and day-to-day job tasks.
Touch up profile photos and alter video, voice and backgrounds.
Run several fake worker personas at the same time.

Jasper Sleet is the group behind fake remote IT workers. It uses false identities to get real remote jobs. Microsoft says its AI-assisted resume work has improved in speed, scale and relevance over the past year.

Onyx Sleet created more than 100 PDF lure files in August and September 2026. File metadata showed dozens made within minutes, which Microsoft says was highly likely AI output. Those lures targeted South Korean users.

Microsoft also flagged possible AI voice and video generation by Emerald Sleet. It could not confirm the full impact yet.

3. Malware built with AI coding tools

Microsoft says AI development platforms, including Cursor, likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet. They used them to write, convert, debug and refactor code, and to fix errors in their tools.

Two cases stand out for dev teams:

Coral Sleet has run a workflow since April 2026 to trojanize private GitHub repositories. Microsoft says this was highly likely built with an AI coding platform.
Sapphire Sleet likely used AI in the August 2026 Rust software compromise, which targeted Rust developers. Its malware was a clear step up from its earlier work.

Faster coding also means faster retooling. When defenders block one version, the attackers can ship a new one quickly.

4. Scaling operations with agents

Since late October 2026, Onyx Sleet and Pearl Sleet have used ARTEX, an open-source agentic AI penetration testing framework, in live operations. The groups also use AI to summarize stolen data and speed up decisions after a break-in.

TokenPost's summary of the Microsoft findings reported the same split: three groups operationalized, four accelerating and one expanding.

Why North Korean Hackers Matter to IT Agencies

Agencies sit at a risky crossing point. We hire remote talent, we hold client code, and we give contractors access to client systems. Each of those is a door these groups already knock on.

Here is how the report maps to normal agency life:

Tactic in the report	Where it hits an agency
Fake remote IT workers (Jasper Sleet)	Freelancer and contract hiring, staffing partners
Fake recruiters with coding "tests" (Jade Sleet)	Your own developers who take outside interviews
Trojanized private repos (Coral Sleet)	Client repositories and shared GitHub orgs
Developer-targeted supply chain attacks (Sapphire Sleet)	Packages and tools your team installs daily

This is not just a US problem. Teams in India often work as remote extensions of US clients. If a fake hire slips into your bench, your client's code is exposed too.

The FBI has already warned about the next step. Its public alert on North Korean IT workers says some have held stolen code hostage for ransom after being discovered. It also notes they copied company GitHub repositories to personal accounts.

A Practical Checklist Against North Korean Hackers

None of this needs a big budget. Most steps are process fixes. I've grouped them the way we run them at Debugged Pro.

Hiring and vendor checks

These come straight from Microsoft's guidance on vetting candidates:

Look harder at staffing company hires. Microsoft calls this the easiest way in for North Korean workers.
Compare profiles. Watch for LinkedIn or GitHub accounts that look almost identical to others.
Check the phone number. It should be unique, and ideally not a VOIP number.
Match the details. Names, addresses and dates on the resume and background check should line up.
Call references. Use phone or video, not email alone.
Insist on camera. See the candidate on video in more than one session. Repeated "camera issues" are a red flag.
Check for double jobs. Search whether the same persona works at several companies.

Developer and repo safety

Give least privilege. New contractors should get only the repos they need.
Watch repo activity. Flag clones of private repos to personal accounts, as the FBI advises.
Treat outside coding tests as risky. Tell your devs never to run "take-home" code from unknown recruiters on work laptops.
Review new dependencies. Pin versions and check packages before they reach client builds.

Our recent piece on the Claude Code extension supply chain attack covers more editor and extension controls.

Email, login and endpoint basics

Run phishing training with realistic recruiter and job-offer lures.
Block device code sign-in flow where you do not need it, as Microsoft recommends.
Turn on link and attachment scanning in your email platform.
Run endpoint protection in block mode on every dev machine.
Watch for logins to one account from many countries in a short time.

If you use AI agents in your own workflows, our guide on AI agent security and human approval is a useful next read.

What This Means for Clients in India and the USA

Clients will start asking about this. Larger US buyers already ask vendors how they verify remote staff. Expect that question to show up in more security reviews.

A clear, written hiring and access policy helps you win those deals. It also protects you if something goes wrong. If you need help setting up safer delivery processes, our software development consulting team does this work every week.

My honest view: AI did not invent new attacks here. It made old ones cheaper. The agencies that stay safe will be the ones that do the boring checks every single time.

A Simple 30-Day Plan

If the checklist feels like a lot, split it across four weeks. This is the order I would follow.

Week 1: List every contractor and staffing partner with access to client code. Remove access nobody uses.
Week 2: Add the camera, phone and reference checks to your hiring template. Share it with recruiters.
Week 3: Brief your developers on fake recruiter lures and take-home test risks. Keep it to one short call.
Week 4: Review repo logs and login alerts. Set a monthly reminder to repeat the review.

Small, repeated habits beat a one-time audit. Attackers only need one gap, so the routine is the real defense.

Key Takeaways

Microsoft tracked eight North Korean groups using AI, with three at the fully operationalized stage.
IT companies and software supply chains are listed among the usual targets.
Fake recruiters and fake remote workers are the biggest risks for agencies.
AI coding tools likely helped build malware and a private repo trojanizing workflow.
Attacks are still human-directed, so solid hiring checks and access controls still work.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He manages remote dev teams, hiring and client delivery for businesses in India and the USA. He writes about the AI and security news that changes how agencies work.