Deceptive Employment Scheme: AI-assisted hiring deception

This case study was originally published in OpenAI’s February 2025⁠(opens in a new window) report.

We banned a number of accounts that were potentially used to facilitate a deceptive employment scheme. The activity we observed is consistent with the tactics, techniques, and procedures (TTPs) Microsoft⁠(opens in a new window) and Google⁠(opens in a new window) attributed to an IT worker scheme potentially connected to North Korea.

While we cannot determine the locations or nationalities of the actors, the activity we disrupted shared characteristics publicly reported⁠(opens in a new window) in relation to North Korean state efforts to funnel income through deceptive hiring schemes, where individuals fraudulently obtain positions at Western companies to support the regime’s financial network.

The various accounts used our models to generate content seemingly targeting each step of the recruitment process with different deceptive practices, all designed to be mutually supporting.

The actors used virtual private networks (VPNs), remote access tools such as AnyDesk, and voice over IP (VOIP) phones largely appearing to be located in the United States. While our visibility into the ways these actors distributed their content is limited, we identified content posted to LinkedIn.

One main set of content generated by these actors consisted of personal documentation for the fictitious “job applicants,” such as resumés, online job profiles, and cover letters. These resumés and profiles were frequently tailored to a specific job listing to increase the chances of appearing as a well-qualified candidate. A second set consisted of creating “support” personas, which were used to provide reference checks for the “job applicants” and refer them for employment opportunities.

In parallel, the operators crafted social media posts to recruit real people to support their schemes. These included, for example, individuals willing to receive and host laptops from their home or lend their identities to the scheme to enable the applicants to pass background checks.

Finally, the “job applicant” personas appear to have used our models in interviews to generate plausible responses to technical and behavioral questions. However, we did not observe them using our speech-to-speech tools.

After appearing to gain employment they used our models to perform job-related tasks like writing code, troubleshooting, and messaging with coworkers. They also used our models to devise cover stories to explain unusual behaviors such as avoiding video calls, accessing corporate systems from unauthorized countries, or working irregular hours.

Given our visibility into only a small portion of this overall set of activity, assessing its impact would require inputs from multiple stakeholders.

OpenAI’s policies strictly prohibit use of output from our tools for fraud or scams. Through our investigation into deceptive employment schemes, we identified and banned dozens of accounts. We have shared insights about the fraudulent networks we disrupted with industry peers and relevant authorities, enhancing our collective ability to detect, prevent, and respond to such threats while advancing our shared safety.