Generic desk scene used for illustration; not a suspected worker or an affected company. Photo: Marcin Skalij / Unsplash.
NEW YORK, Nov. 5, 2026 – CrowdStrike says it is finding one or two suspected North Korean IT-worker cases every day, a warning that remote-hiring fraud can become a threat to company systems and sensitive information, Fox News reported Thursday.
Adam Meyers, the cybersecurity company’s head of counter adversary operations, told Fox News Digital that the workers apply broadly, from consumer businesses to defense contractors. In some cases, he said, CrowdStrike has seen access handed to malware teams when a target presents intelligence value.
Meyers did not say whether those teams successfully collected sensitive information after the handoffs. The daily figure describes CrowdStrike’s own suspected-case detections, not a government count of confirmed infiltrations or a nationwide total.
A hiring problem with a security consequence
The concern extends beyond paying a worker who has misrepresented an identity. Once someone is hired, ordinary employee permissions can provide access to corporate systems and data. Meyers said companies should treat identity verification as a security responsibility shared by recruiters and security teams, rather than simply an administrative step in hiring.
In an Oct. 13 public alert, the FBI said North Korean IT workers use stolen identities and increasingly rely on U.S.-based facilitators. Those facilitators may receive and host employer-issued computers, allowing people overseas to work through a U.S. physical location. The bureau said the schemes generate revenue for North Korea’s government and create national-security and intellectual-property risks.
The FBI also warned that workers target jobs with cleared defense contractors and other government contractors, and seek people with security clearances or specialized qualifications. That does not mean every suspected worker has reached sensitive systems, or that a job offer amounts to a successful intrusion.
Earlier federal actions show the breadth
The Justice Department’s Oct. 13 announcement described a charged scheme affecting more than 70 U.S. employers and generating approximately $3 million for the workers. The employers included businesses in health care, communications, cyber support, retail and manufacturing.
The coordinated announcement included charges against 14 people, two arrests and the seizure of approximately 187 computer devices. The Texas component, called Operation Lonestar Roundup, involved searches and other law-enforcement action at more than 40 residences known or suspected to be hosting computers for North Korean IT workers.
Those Texas actions took place Sept. 21-25 and were announced Oct. 13. They were not raids carried out Thursday. The approximately 187 devices included laptops and keyboard-video-mouse equipment, rather than 187 laptops alone. The charges are allegations, and defendants are presumed innocent unless proven guilty.
The employer count in that prosecution and CrowdStrike’s daily detections measure different things. They should not be added together or treated as estimates of the total number of affected American companies.
What employers can do without shutting out real applicants
The FBI recommends layered identity checks and access controls throughout employment, not reliance on a single document, interview or warning sign. It says human resources, IT, security and management teams should combine what they know when reviewing possible identity fraud.
For employers, that means checking that the person doing the work is the person hired, reviewing access in relation to the job, and taking multiple inconsistencies seriously enough to investigate. A review should continue after onboarding rather than end when a new hire receives a computer.
There is also a risk in overreacting. The FBI says aggressive filters can harm legitimate remote employees, exclude qualified applicants and penalize victims whose identities were stolen. It cautions against relying only on lists of names or other isolated indicators. Suspicion calls for substantive review, not an automatic conclusion about an applicant’s nationality or guilt.
Individuals should reject paid requests to lend personal information, account access or a home location to someone else’s employment arrangement, the FBI says. Businesses and people approached about a suspected scheme can contact their local FBI field office and submit a report through IC3.
Thursday’s development is CrowdStrike’s account of continuing suspected cases and possible access handoffs. It is not an announcement of new sanctions, a new federal operation or proof that every suspected case resulted in stolen information.
JBizNews Desk | New York
© JBizNews.com. All rights reserved. Unauthorized reproduction or redistribution is strictly prohibited.
