Canadian Government Advisory Warned of North Korean IT Workers Using AI-Enabled Deepfake Technology
A joint advisory by the RCMP, Public Safety Canada, Global Affairs Canada, FINTRAC, and CCCS warned that North Korean operatives use AI-enabled deepfake technologies to obtain remote IT positions, posing as freelancers, with income funding DPRK weapons programs.
On July 16, 2025, the RCMP, Public Safety Canada, Global Affairs Canada, FINTRAC, and the Canadian Centre for Cyber Security issued a joint advisory warning that North Korean nationals were using AI-enabled deepfake technologies to secure remote IT positions, posing as legitimate freelancers based in other nations (RCMP, 2025; BNN Bloomberg, 2025).
The advisory warned that operatives use AI-enabled deepfake technology to disguise their appearances during meetings and interviews, and that AI tools are used in the application process (RCMP, 2025). Once employed, the advisory stated, North Korean IT workers may insert passive malware and backdoors into program codes that can collect information, monitor traffic, or facilitate future exploitation (RCMP, 2025). The generated income funds the DPRK regime's weapons programs (RCMP, 2025).
The advisory identified target sectors including mobile and web application development, gaming and online gambling, general IT support, graphic animation, database and online platform development, and hardware and firmware development (RCMP, 2025; BNN Bloomberg, 2025). It noted that small businesses and startups are particularly attractive targets (RCMP, 2025).
Microsoft threat intelligence published a report on June 30, 2025 documenting the activity cluster it designates Jasper Sleet (formerly Storm-0287), describing the evolution of North Korean IT worker tactics including the use of face-swapping tools for identity documents and experimental use of voice-changing software (Microsoft Security Blog, 2025). Microsoft stated it had not yet observed combined AI voice and video products used in interviews but assessed this capability could enable future campaigns (Microsoft Security Blog, 2025).
The advisory referenced aligned advisories from Australia, the Republic of Korea, and the United States addressing the same threat (RCMP, 2025).
Materialized From
Harms
North Korean operatives use AI-enabled deepfake technology to disguise their identities during remote hiring, obtaining IT positions where they may insert malware and backdoors into company codebases and collect internal data, according to a joint Canadian government advisory.
Revenue from fraudulently obtained IT positions is funnelled to the DPRK regime, contributing to weapons program funding through AI-enabled identity fraud.
Evidence
3 reports
- Advisory: North Korean Information Technology (IT) Workers Primary source
Joint advisory confirming DPRK operatives using AI deepfakes to infiltrate Canadian companies
-
Microsoft threat intelligence corroboration; Jasper Sleet activity cluster identification; AI deepfake video evolution
-
Scope of advisory, targeting of Canadian tech and financial firms
Record details
Policy Recommendationsassessed
Organizations hiring remote IT workers should implement enhanced identity verification including live video authentication and reference validation for international applicants
RCMP / Public Safety Canada / Global Affairs Canada / FINTRAC / CCCS Joint Advisory (Jul 16, 2025)Financial institutions should monitor for suspicious patterns in payroll transfers to accounts associated with remote IT workers, particularly patterns consistent with multi-position management, and report suspicious transactions to FINTRAC
RCMP / Public Safety Canada / Global Affairs Canada / FINTRAC / CCCS Joint Advisory (Jul 16, 2025)Editorial Assessment assessed
This advisory from five Canadian government agencies warns of an active threat where AI-enabled deepfake technology facilitates state-directed infiltration of companies through remote hiring (RCMP, 2025; BNN Bloomberg, 2025). Microsoft's Jasper Sleet research documents the evolution of tactics, noting that combined AI voice and video products could enable more sophisticated infiltration in future (Microsoft Security Blog, 2025).
Entities Involved
Taxonomyassessed
Changelog
| Version | Date | Change |
|---|---|---|
| v1 | Mar 11, 2026 | Initial publication |
| v2 | Mar 11, 2026 | Neutrality and factuality review: corrected policy recommendation attribution (both recommendations come from the single joint advisory, not a separate FINTRAC document); added French translations for recommendations. No narrative changes needed — facts verified against primary sources. |