AI Weekly Malaysia

North Korean IT worker fraud schemes are expanding beyond IT roles into healthcare, sales, and marketing, with threat actors using stolen identities, VPNs (Astrill), proxy services (IPRoyal), and KVM switches (PiKVM, TinyPilot) to fraudulently secure remote jobs at Fortune 500 and private firms. Huntress reported a February 2026 case at an Australian healthcare company where three employees were flagged as DPRK workers impersonating Chinese nationals, detected via VPN/proxy patterns, fraudulent identity documents, and word anomalies in utility bills.

Why: Founders and hiring managers in Malaysia hiring remote workers—especially from China, Southeast Asia, or globally—should add identity verification steps: check for VPN/proxy IP inconsistencies during onboarding, scrutinize utility bill proofs for anomalies, and watch for KVM device signatures like PiKVM or TinyPilot on company-issued hardware. The scheme's expansion into non-IT roles means sales, marketing, and healthcare hires are now in scope, not just developers.