Case microsoft-jasper-sleet-faceswapDeepfake fraudUnited States
Jasper Sleet IT workers used Faceswap and voice changers; thousands of accounts cut
Microsoft detailed Jasper Sleet inserting DPRK workers' faces into stolen ID documents with Faceswap, using voice changers in interviews and AI to tailor fake resumes, and said it disrupted thousands of accounts.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 6, 2026
- Location
- United States
- Target
- Western employers hiring remote IT staff
- Severity
- High
- Triggered by
- Jasper Sleet (North Korea)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Microsoft detailed Jasper Sleet inserting DPRK workers' faces into stolen ID documents with Faceswap, using voice changers in interviews and AI to tailor fake resumes, and said it disrupted thousands of accounts.
Impact: Fraudulent hires across Western companies; dollar figures not published.
Who triggered it
Actor: Jasper Sleet (North Korea)
Attribution: Microsoft Threat Intelligence attributes Jasper Sleet to the DPRK remote IT worker programme.
Motive: Sanctions-evading revenue and insider access
How it happened
Attack vector: AI image manipulation, voice alteration and LLM-written applicant materials
Root cause: Identity vetting relies on documents and video that generative tools can now fake
Timeline
- Microsoft publishes initial Jasper Sleet guidance
- Microsoft details AI tradecraft and reports thousands of accounts disrupted
Response
Thousands of accounts disrupted, Defender XDR detections and hunting queries released, industry partnerships.
Current status: Ongoing
Sources (open in a new tab)
- Microsoft Security Blog microsoft.com
- Robinson and Cole summary dataprivacyandsecurityinsider.com
Cite this case
Jasper Sleet IT workers used Faceswap and voice changers; thousands of accounts cut. AI Threat Watch, case microsoft-jasper-sleet-faceswap, Mar 6, 2026. https://aithreat.io/cases/microsoft-jasper-sleet-faceswap/
Permanent link: https://aithreat.io/cases/microsoft-jasper-sleet-faceswap/