Imposter for hire: How fake people can gain very real access

In the latest edition of our Cyberattack Series, Microsoft Incident Response describes a real-world case where four compromised user accounts connected PiKVM devices to employer workstations, enabling remote control as if the attacker were onsite. Cybercriminals posed as legitimate remote hires, bypassing onboarding checks to gain trusted access and exfiltrate data from the network, with the operation traced to the North Korean remote IT workforce known as Jasper Sleet, according to Microsoft Threat Intelligence.

PiKVM devices—low-cost, hardware-based remote access tools—were utilised as egress channels to maintain persistent, out-of-band access and circumvent traditional endpoint detection and response controls, with an identity linked to Jasper Sleet authenticated into the environment. DART pivoted from threat hunting to a full investigation, employing tools such as Cosmic, Arctic, and Fennec, alongside Microsoft Entra ID protection and Defender solutions, to contain the attack and restore operational integrity.

Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake, a sign of growing concern about candidate fraud in the job market.