The ghost workforce: Lessons from emulating North Korean cyber tradecraft

Ghost workers represent a fast‑growing form of identity fraud in which false, stolen, or synthetically constructed identities are used to secure legitimate roles inside real organisations. Once embedded, these fabricated personas blend into the workforce drawing salaries, receiving equipment, and gaining access to internal systems and sensitive data. The rise of remote work has stripped away many traditional validation points, making it easier for adversaries to slip through hiring and onboarding processes. While some ghost‑worker activity is financially motivated, others act as strategic footholds for broader cyber operations.