Unsuspecting Americans on LinkedIn Help North Korea Spies Infiltrate Companies via Remote Jobs

A former waitress in Minnesota became entangled in an elaborate scam that funneled millions of dollars to North Korea through a network of remote workers using stolen U.S. identities. The scheme also enabled North Korean spies to snoop on Zoom meetings and download sensitive materials from the companies that hired them.

The Wall Street Journal reports that federal prosecutors have uncovered an intricate scam orchestrated by North Korea, involving the infiltration of the U.S. remote jobs market. The scheme, which has netted an estimated $17.1 million from over 300 American companies, relied on the unwitting participation of everyday Americans like Christina Chapman, a 50-year-old former waitress and massage therapist from Minnesota.

Chapman’s involvement began in March 2020 when she received a LinkedIn message asking her to “be the U.S. face” for a company that secured jobs for overseas IT workers. Unbeknownst to her, the workers were North Koreans using stolen U.S. identities. Chapman’s role was to provide an American cover, accepting deliveries of company laptops, setting up online connections, and facilitating paychecks. She operated a “laptop farm” from her home in Arizona, at one point housing over 90 computers used by the North Korean workers.

The FBI estimates that this scam involves thousands of North Korean workers and brings in hundreds of millions of dollars annually for the cash-strapped country. The workers, typically technology specialists trained in North Korea, seek employment with Western companies while hiding their true identities and locations. They often enlist the help of U.S. citizens to pass “liveness checks” and create legitimate accounts on freelance platforms.

The North Koreans have proven adept at circumventing corporate controls, even using generative AI to alter their appearance during online job interviews. Once employed, some workers have been caught downloading sensitive data, potentially for espionage or ransom purposes. The sophisticated programs they install on company laptops can enable them to spy on Zoom meetings and exfiltrate data undetected.

Chapman, who earned just under $177,000 for her role, pleaded guilty to wire fraud, identity theft, and money laundering charges in February 2025. She faces a maximum sentence of just over nine years in prison.