Case microsoft-jasper-sleet-ai-identitiesDeepfake fraudUnited States
Microsoft: DPRK's Jasper Sleet IT workers use AI to forge IDs; 3,000 accounts suspended
Microsoft reported DPRK remote IT workers (Jasper Sleet) use AI to swap faces into stolen ID documents, polish photos and resumes and test voice changers; it suspended 3,000 Outlook and Hotmail accounts they created.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 30, 2025
- Location
- United States
- Target
- US companies hiring remote IT workers
- Severity
- High
- Triggered by
- Jasper Sleet (North Korean remote IT worker program)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Microsoft reported DPRK remote IT workers (Jasper Sleet) use AI to swap faces into stolen ID documents, polish photos and resumes and test voice changers; it suspended 3,000 Outlook and Hotmail accounts they created.
Impact: Hundreds of jobs at US firms believed infiltrated; crypto payments averaging nearly $3 million per month traced to DPRK-linked workers in 2025
Who triggered it
Actor: Jasper Sleet (North Korean remote IT worker program)
Attribution: Microsoft Threat Intelligence attribution to North Korea; consistent with US DOJ indictments of DPRK IT workers and facilitators
Motive: Sanctions-evading revenue for the DPRK regime, with potential for data theft and extortion
How it happened
Attack vector: AI-edited identity and employment documents, enhanced profile photos, stolen US identities and laptop farms to secure remote jobs
Root cause: Remote hiring and identity checks that accept scanned documents and photos which generative tools can convincingly alter
Timeline
- Microsoft finds a public repository with worker photos, resumes, VPN guides and payment records
- DOJ indicts two North Koreans and three facilitators who earned at least $866,255 from ten of 64 infiltrated US firms
- Microsoft publishes Jasper Sleet report and suspends 3,000 accounts
- The Record reports ZachXBT tracing over $16.5 million in crypto to known DPRK IT workers since January 2025
Response
Account suspensions, detection guidance for employers, coordination with DOJ actions against laptop farms in 16 states
Current status: Ongoing
Sources (open in a new tab)
- Microsoft Security Blog microsoft.com
- The Record therecord.media
Cite this case
Microsoft: DPRK's Jasper Sleet IT workers use AI to forge IDs; 3,000 accounts suspended. AI Threat Watch, case microsoft-jasper-sleet-ai-identities, Jun 30, 2025. https://aithreat.io/cases/microsoft-jasper-sleet-ai-identities/
Permanent link: https://aithreat.io/cases/microsoft-jasper-sleet-ai-identities/