Contents
In short: North Korean IT workers get hired by companies as remote workers, using stolen identities and AI-swapped photos. The company laptop is sent to an accomplice who keeps it online at the location of the job: a "laptop farm". One Arizona woman, Christina Chapman, ran one at home: more than 90 laptops were seized, 309 US businesses were defrauded, and the scheme made more than $17 million for her and North Korea. She was sentenced to 102 months. In September 2026 the FBI searched more than 40 homes in Texas. The fix: see the candidate on camera more than once, with ID in hand, and watch for remote-desktop tools.
The interview
The FBI: "North Korean IT workers have been observed using artificial intelligence and face-swapping technology during video job interviews to obfuscate their true identities."
The identities themselves are stolen. Microsoft Threat Intelligence: "North Korean IT workers appear to conduct identity theft and then use AI tools like Faceswap to move their pictures over to the stolen employment and identity documents."
The laptop goes to a US home
Microsoft again: "Once hired, the remote workers direct company laptops and hardware to be sent to the address of the accomplice. The accomplice then either runs a laptop farm that provides the laptops with an internet connection at the geo-location of the role or forwards the items internationally."
One home in Arizona
One case is Christina Chapman's. According to the US Justice Department's release (published by IRS-CI): "Chapman operated a 'laptop farm' where she received and hosted computers from the U.S. companies at her home, deceiving the companies into believing that the work was being performed in the United States."
The scale: "More than 90 laptops were seized from Chapman's home following the execution of a search warrant in October 2023."
309 businesses, $17 million
"The case involved one of the largest North Korean IT worker fraud schemes charged by the Department of Justice, with 68 identities stolen from victims in the United States and 309 U.S. businesses and two international businesses defrauded."
The money went through her: "Chapman received and forged payroll checks in the names of the stolen identities used by the IT workers and received IT workers' wages through direct deposit from U.S. companies into her U.S. financial accounts."
In total: "The scheme generated more than $17 million in illicit revenue for Chapman and for the Democratic People's Republic of Korea (DPRK or North Korea)."
Not every laptop stayed on her shelves: "Chapman also shipped 49 laptops and other devices supplied by U.S. companies to locations overseas, including multiple shipments to a city in China on the border with North Korea."
102 months
"An Arizona woman was sentenced today to 102 months in prison for her role in a fraudulent scheme that assisted North Korean Information Technology (IT) workers posing as U.S. citizens and residents".
Still going
On 13 October 2026, the Justice Department reported: "Between Sept. 21 and Sept. 25, the FBI conducted searches and other law enforcement action at over 40 residences in Texas known to be, or suspected of operating as, laptop farms."
Caught, they extort
The FBI: "After being discovered on company networks, North Korean IT workers have extorted victims by holding stolen proprietary data and code hostage until the companies meet ransom demands."
The fix
- On camera, more than once. Microsoft: "Ensure the potential employee is seen on camera during multiple video telecommunication sessions."
- ID held up to the camera. Microsoft: "During video verification, request individuals to physically hold driver's licenses, passports, or identity documents up to camera."
- Watch for remote-desktop tools. The FBI: "Monitor and investigate unusual network traffic, to include remote connections to devices or the installation/presence of prohibited remote desktop protocols or software."
A warning to hosts
In June 2025, Brett Leatherman of the FBI's Cyber Division said: "Let the actions announced today serve as a warning: if you host laptop farms for the benefit of North Korean actors, law enforcement will be waiting for you."
Sources
- FBI, PSA 250123: North Korean IT Workers Conducting Data Extortion, 23 Jan 2025
- Microsoft Threat Intelligence, Jasper Sleet: North Korean remote IT workers' evolving tactics to infiltrate organizations, 30 Jun 2025
- IRS-CI (DOJ release), Arizona woman sentenced for $17M information technology worker fraud scheme that generated revenue for North Korea, 24 Jul 2025
- US Department of Justice, coordinated nationwide actions to combat North Korean remote IT workers, 30 Jun 2025
- US Department of Justice, coordinated actions affecting more than 70 U.S. companies, 13 Oct 2026
The video is animated with code and the script was written with AI assistance; every figure above is checked against the sources. Illustrative: the faces and ID cards (not real people), the glitching interview, the house and its shelves, and the remote-desktop icon. This post explains the risk and the fix, not how the workers connect. Made with Shotloop, my free Mac app for code-made explainers, fixed one shot at a time.