Microsoft traces fraudulent IT-worker access from hiring to cloud activity

Microsoft’s 21 April report describes North Korea-aligned activity it tracks as Jasper Sleet. Researchers say the operators use fabricated or stolen identities and tailored applications to enter remote technical roles. The account follows the process from researching vacancies to recruiting and later access to organisational systems.

The security concern is the legitimate account and permissions an infiltrator can receive after hiring. Microsoft examines cloud and identity signals across that lifecycle, alongside recruitment-stage deception. A suspicious technical event needs investigation in its own context; nationality, a remote working arrangement or a polished application does not establish malicious intent. The report attributes a particular activity cluster using Microsoft’s intelligence and does not identify all fraudulent applicants as part of one operation.