How a tempting side-income opportunity reveals a potential way DPRK operators recruit people to provide access to their identities.
We have been tracking North Korea-linked (DPRK) fake applicants. This is the second entry in our series of threat research findings. Read the first entry here.
Who Doesn't Want to Make Money While Sleeping?
Imagine waking up, grabbing your coffee, checking your phone, and discovering you've made money overnight, with no meetings, no deadlines, and no annoying chats notifications. You didn't even open your laptop. It sounds like a pretty good deal, and apparently someone else thinks so too. An email landed in an employee's inbox offering exactly that: extra income while an offshore software development team handles the actual work.
The pitch was simple. You create an account on an AI-training platform, complete the verification, and let the team take care of the projects, and in return you get a share of the money. What could possibly go wrong? There was one tiny detail: the person behind the email was a known DPRK operator, and suddenly this side hustle became a lot more interesting.
One Pitch, Eight Operators, and a Very Convenient Side Hustle
The email wasn't particularly sophisticated. There was no elaborate story and no urgent warning that your account would be suspended in the next 15 minutes, just something far more appealing: easy money. One message asked:
"What if you could earn money even while you're asleep?"
The sender claimed to manage an offshore software development team and wanted people interested in earning extra income, and the best part was that you wouldn't have to do the actual work. You would create an account, complete the verification, and let someone else handle everything in exchange for a share of the earnings. It sounded like a dream job, except that the person offering it wasn't someone you'd want managing your professional identity.
This wasn't an isolated attempt. It surfaced through our ongoing monitoring of DPRK threat activity. Between October 3 and November 6, 2026, the investigation uncovered eight operators reaching thirteen organizations and roughly thirty-eight employees, each using different names and different promises to deliver essentially the same offer. Some promised thousands of dollars a month, others a percentage of the profits, and a few even dangled long-term collaboration. Apparently the easiest way to make money while sleeping is to find someone willing to stay awake and do the work. But why were these recruiters so interested in people who could create and verify accounts? That is where things get interesting.
The Job Description: Exist, Verify, Collect
The recruitment messages focused heavily on AI-training and evaluation platforms, including DataAnnotation, Outlier, Handshake AI, Mercor, Snorkel, and AfterQuery. These are legitimate platforms associated with AI-related work, not malicious services, and with AI becoming everyone's favorite topic, an opportunity to earn money helping train AI models doesn't sound particularly unusual. But the proposed arrangement was a little different from your typical freelance gig, as one recruiter explained:
"You can just make the accounts and allow me to work on that."
That was the whole arrangement: you create the account, someone else does the work, and you split the money. Some recruiters claimed they could generate $8,000 or even $10,000 per month, with the recipient taking anywhere from 30% to 50% of the earnings. The packaging varied from one operator to the next. Some pitched passive income and overnight earnings, while others took a more professional route, like the sender who introduced himself as a senior full-stack and AI engineer based in Singapore looking for a long-term collaborator, or the one who said his previous AI-training account was no longer active and he needed someone to help him access new opportunities. The wording, the introductions, and the splits all changed, but one idea never did: someone with an eligible identity creates the account, and someone else performs the work.
The material also went beyond simply promising a paycheck. It included privacy assurances, references to formal agreements, and instructions not to share passwords or identity documents directly with the recruiters. The arrangement didn't ask people to hand over their passports or driver's licenses; it asked them to complete the verification process themselves. In other words, why worry about getting an identity past verification when you can convince its legitimate owner to do that part for you?
The Google Doc That Explained a Little Too Much
Some recruitment emails included a Google Doc titled Flexible Side-Income Opportunity, and it looked like an ordinary business proposal, with a team introduction, a list of AI-training platforms, screenshots of impressive earnings, compensation details, and even a privacy policy. It showcased supposed weekly earnings of $1,200, 4,100,and~7,100, and it promised 30% of project revenue, a minimum of $150 per month, and a $50 referral incentive for bringing in another eligible participant. Apparently this side hustle came with a referral program too.
But buried among the promises was a particularly revealing explanation. The document noted that many AI-training platforms primarily accept U.S.-based individuals and require identity verification through services such as Persona, and then, almost casually, it added:
"That's why we're seeking your collaboration."
From there the document spelled out exactly what each party would contribute. The offshore team would find projects, prepare applications, perform the AI-related tasks, and manage the work, while the recruited individual would create accounts and complete identity verification. The team brought the skills, the time, and the resources. You bring... yourself, or more precisely your identity.
The Red Flag Isn't the Offer. It's What They're Asking For.
Fraudulent identities already play a central role in DPRK IT-worker operations, but those identities don't appear out of nowhere. Alongside the stolen and fabricated ones, this is what recruiting real people to provide access to their identities can look like: an attractive side-income offer, a promise of easy money, and an offshore team willing to do ALL the work. The person sees a chance to make extra money, while the operator sees access to a verified identity. It is the same deal built on two very different motivations.
An email about freelance AI projects, or a Google Doc describing a business opportunity, might not seem concerning on its own. What matters is what the recipient is being asked to contribute, which is not their technical expertise, their experience, or even their time, but their ability to create and verify an account that someone else wants to use. Unsolicited offers built around account creation, identity verification, revenue sharing, and external teams performing work under someone else's account deserve closer attention, especially when the same recruitment language or shared documents appear across multiple recipients. For operators who need identities to support fraudulent employment activity, recruiting willing participants is a potential way to source them.
Sleeping Is Free. Your Identity Might Not Be.
Across roughly five weeks, this activity added up to eight operators, thirteen organizations, and about thirty-eight contacted employees, all promising extra income, flexible collaboration, and money for very little work. Behind every version of the offer sat the same request: find someone who can create and verify an account that an external team wants to use. There was no elaborate emergency and no manufactured urgency, only the promise of something almost everyone would like, which is EASY MONEY.
So it is worth remembering that if someone offers to do all the work while you provide the identity, the real question is what they are actually paying for. Because the easiest money might come with a job you never knew you applied for.
