# CrowdStrike Says It Finds One or Two Suspected North Korean Fake IT Worker Cases Every Day as Operatives Target Cleared Defense Jobs, Fox News Reports

Fox News says the scheme that began as a money maker for Pyongyang now includes handoffs to malware teams when a target looks valuable. The FBI calls it a significant insider threat. Recent federal cases involve military AI work and top secret clearances.

- Section: [Border & Security](https://rightnewsrightnow.com/border-security/)
- Published: 2026-11-05
- By: RightNewsRightNow Staff
- Canonical page: https://rightnewsrightnow.com/articles/crowdstrike-north-korea-fake-it-workers-one-or-two-cases-daily-cleared-defense-contractors-laptop-farms-famous-chollima-fox-news/

A cybersecurity firm says North Korea's fake remote IT worker scheme has turned from a cash operation into a spying opportunity, Fox News reports.

The scale. CrowdStrike's Adam Meyers, head of counter adversary operations, told Fox News Digital the company is finding one or two suspected cases every day. "They don't discriminate," he said, noting applicants go after jobs in industries from consumer companies to defense contractors. CrowdStrike calls the campaign Famous Chollima and has tracked it since March 2024. It links the group to North Korea's Munitions Industry Department.

The shift. The main aim is revenue for the regime's weapons programs, Meyers said. But when workers land at a "particularly juicy target," CrowdStrike has seen the operation handed to a malware team. Meyers did not say whether those teams successfully took sensitive information. The FBI calls the scheme a "significant national security and intellectual property theft insider threat" and says workers are targeting cleared defense contractors and even active-duty troops who can host company laptops.

The cases. Fox points to a network of U.S.-based "laptop farms" that helped overseas workers get remote jobs at more than 100 American companies. In one indictment, a worker using a stolen American identity was hired as a remote software engineer at a California defense contractor in January 2024 and, prosecutors say, downloaded material controlled under arms export rules. A case unsealed last week involved the identity of a Virginia man who worked for a cleared defense contractor and held an active Top Secret clearance. One impostor got a $130,000 offer on a military generative AI project, and was caught on a video call. A second sought a $170,000 role requiring Top Secret/SCI clearance, and the company's background check caught the discrepancies. Fox says neither impostor did the sensitive work.

The tools. Meyers said operatives use artificial intelligence to build LinkedIn profiles, answer interview questions, change their appearance on video calls, and sometimes do the job. The FBI says workers buy access to identity-verification services to test stolen identities and may hire Americans to appear on camera.

The response. Fox says that in October the FBI searched more than 40 suspected laptop farms across Texas and seized 187 devices, with actions affecting more than 70 U.S. companies. Treasury sanctioned another North Korean IT-worker network last week. Meyers urged companies to treat identity verification as a security issue, not just a hiring step.

Why it matters here. We have reported on North Korean crypto theft in earlier editions. This story shows the same regime reaching American firms through ordinary job applications, including firms that hold military contracts.

What we could not check. We did not see the indictments, FBI statements or CrowdStrike data. The "one or two a day" figure is the company's own and is not independently verified in the report. Fox does not say how many American firms were successfully penetrated.

## Source

Original reporting: [Fox News](https://www.foxnews.com/politics/north-korea-fake-it-worker-scheme-takes-dangerous-turn-new-threats-emerge-every-day)