> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Fake North Korean IT workers reached onboarding, Material Security finds
- URL: https://stackurity.ai/blog/north-korean-fake-it-workers-reached-onboarding-open-data/
- Published: 2026-11-15T01:35:04.000Z
- Updated: 2026-11-15T01:35:03.000Z
- Description: Material Security tracked suspected North Korean fake IT workers through hiring and found broad file sharing waiting. What to tighten and what Stackurity covers.
- Author: Stackurity Research Team
- Tags: Linux Servers, News

**TL;DR:** Material Security tracked suspected North Korean fake IT workers through hiring and found that 27 fabricated personas reached onboarding in a year. Where they got in, internal files were often shared far too widely.

## What happened

[Help Net Security](https://www.helpnetsecurity.com/2026/11/13/north-korean-it-workers-onboarding/) reports on research by Material Security into fabricated job seekers, complete with invented résumés and faces, who apply for remote engineering roles. The firm watched the organisations it monitors over one year and counted 27 personas that made it through to onboarding.

The finding that matters for security teams is what such a person would find on day one. According to the report, at one company where a persona reached that stage, a very large collection of files containing Social Security numbers was shared with everyone in the company or through public links. A new hire, real or fake, inherits that access by default.

## What to do about it

- Give new engineers the access their first week needs, and nothing more. Widen it with approvals.
- Review company-wide and public sharing links for shared drives and wikis, and remove the ones nobody can justify.
- Check identity during hiring: video interviews, document verification and a check that the person onboarding is the person who interviewed.
- Watch for access to repositories, servers and cloud accounts that does not match the role.

## Am I affected?

Any company that hires remote engineers can meet this. The exposure is largest where onboarding grants broad access to documents, code and servers.

## How to check with Stackurity

Stackurity does not cover hiring checks or document sharing settings. It inventories the software on your servers, repositories and images, matches it against advisories and end-of-life dates, and finds keys, tokens and passwords written in files, so a secret that a new hire could read in a repository or on a server is something it can show you. See the [remediation documentation](https://stackurity.ai/docs/remediation) for how leaked keys are graded and tracked.

[Start a free trial of Stackurity](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=linux-servers&utm%5Fcontent=north-korean-fake-it-workers-reached-onboarding-open-data) to see which keys and tokens sit in your repositories and servers.

Sources: [Help Net Security](https://www.helpnetsecurity.com/2026/11/13/north-korean-it-workers-onboarding/).