In a LinkedIn post this week, Schmidt said the suspicious applications were linked to candidates using stolen or fabricated identities to apply for remote IT and technology roles. The effort, he explained, appears aimed at securing wages that could be funnelled back to support North Korea’s weapons programmes and broader regime priorities, reports the Saudi gazette.

“Their objective is typically straightforward: get hired, get paid, and funnel wages back to fund the regime’s weapons programs,” Schmidt wrote, as reported by multiple news outlets.

The attackers used a range of deceptive tactics, including hijacking dormant professional profiles on platforms like LinkedIn and creating fake résumés that mimicked real software engineers. Some fraudsters also collaborated with so-called “laptop farms”, computers based inside the United States but controlled from abroad, to give the appearance of legitimate, domestic remote workers, reveals The Business Standard.

In order to screen applicants, Amazon deployed a combination of artificial intelligence tools and manual verification by human reviewers. AI models scan for red flags such as links to high-risk organisations, inconsistent education histories, unusual phone formats, and other anomalies, after which staff conduct deeper background checks.

Security experts warn that threats tied to remote work scams are rising across the tech sector, and authorities in the U.S. have uncovered similar schemes involving laptop farms and identity fraud tied to North Korean IT workers.