🐦 Twitter Post Details

Viewing enriched Twitter post

@efipm

🚨 North Korea lures engineers to rent identities in fake IT worker scheme 🇰🇵 📌 Famous Chollima / Lazarus Group is using a new tactic: renting real engineers’ identities to infiltrate companies. Instead of relying solely on stolen credentials, the group now walks up “front-men” — legitimate engineers who agree to rent out their identity for remote IT jobs. This lets the real threat actors from North Korea operate under the radar while the “front-man” handles any identity or compliance checks. 📌 They combine advanced social-engineering, AI, and remote-access toolchains to evade detection. The campaign uses AI-enhanced fake resumes, deep-fake video interviews, and remote-access software (VPNs, desktop-sharing) to mask the true origin of activity. The “front-man” may never do the actual technical work — the DPRK operatives do. 📌 This isn’t a small-scale hack: Hundreds to thousands of global companies are potentially exposed, spanning not just tech but finance, healthcare, crypto, and more. Researchers have documented systematic outreach, mass applications via platforms like GitHub and freelancer sites, and infiltration attempts at major corporations — highlighting this as a global security and supply-chain threat. Sources: [1] https://t.co/V34xd5kg10 | [2] TechCrunch

Media 1
Media 2

📊 Media Metadata

{
  "media": [
    {
      "url": "https://crmoxkoizveukayfjuyo.supabase.co/storage/v1/object/public/media/posts/1998045254298071140/media_0.jpg?",
      "media_url": "https://crmoxkoizveukayfjuyo.supabase.co/storage/v1/object/public/media/posts/1998045254298071140/media_0.jpg?",
      "type": "photo",
      "filename": "media_0.jpg"
    },
    {
      "url": "https://crmoxkoizveukayfjuyo.supabase.co/storage/v1/object/public/media/posts/1998045254298071140/media_1.jpg?",
      "media_url": "https://crmoxkoizveukayfjuyo.supabase.co/storage/v1/object/public/media/posts/1998045254298071140/media_1.jpg?",
      "type": "photo",
      "filename": "media_1.jpg"
    }
  ],
  "processed_at": "2025-12-08T22:21:39.450103",
  "pipeline_version": "2.0"
}

🔧 Raw API Response

{
  "type": "tweet",
  "id": "1998045254298071140",
  "url": "https://x.com/efipm/status/1998045254298071140",
  "twitterUrl": "https://twitter.com/efipm/status/1998045254298071140",
  "text": "🚨 North Korea lures engineers to rent identities in fake IT worker scheme 🇰🇵\n\n📌 Famous Chollima / Lazarus Group is using a new tactic: renting real engineers’ identities to infiltrate companies. \nInstead of relying solely on stolen credentials, the group now walks up “front-men” — legitimate engineers who agree to rent out their identity for remote IT jobs. This lets the real threat actors from North Korea operate under the radar while the “front-man” handles any identity or compliance checks.  \n\n📌 They combine advanced social-engineering, AI, and remote-access toolchains to evade detection.\nThe campaign uses AI-enhanced fake resumes, deep-fake video interviews, and remote-access software (VPNs, desktop-sharing) to mask the true origin of activity. The “front-man” may never do the actual technical work — the DPRK operatives do. \n\n📌 This isn’t a small-scale hack: Hundreds to thousands of global companies are potentially exposed, spanning not just tech but finance, healthcare, crypto, and more. \n\nResearchers have documented systematic outreach, mass applications via platforms like GitHub and freelancer sites, and infiltration attempts at major corporations — highlighting this as a global security and supply-chain threat.\n\nSources: [1] https://t.co/V34xd5kg10 |  [2] TechCrunch",
  "source": "Twitter for iPhone",
  "retweetCount": 1,
  "replyCount": 0,
  "likeCount": 2,
  "quoteCount": 0,
  "viewCount": 160,
  "createdAt": "Mon Dec 08 15:01:25 +0000 2025",
  "lang": "en",
  "bookmarkCount": 0,
  "isReply": false,
  "inReplyToId": null,
  "conversationId": "1998045254298071140",
  "displayTextRange": [
    0,
    268
  ],
  "inReplyToUserId": null,
  "inReplyToUsername": null,
  "author": {
    "type": "user",
    "userName": "efipm",
    "url": "https://x.com/efipm",
    "twitterUrl": "https://twitter.com/efipm",
    "id": "117780256",
    "name": "Dr Efi Pylarinou",
    "isVerified": false,
    "isBlueVerified": true,
    "verifiedType": null,
    "profilePicture": "https://pbs.twimg.com/profile_images/1771506727768219648/cA1FG4kI_normal.jpg",
    "coverPicture": "https://pbs.twimg.com/profile_banners/117780256/1711213133",
    "description": "Top Global Fintech & Tech Influencer • Trusted by Finserv & Tech Global • Content & Influencer Services • Advisory for Digital Transformation • Speaking",
    "location": "Switzerland",
    "followers": 27416,
    "following": 10329,
    "status": "",
    "canDm": false,
    "canMediaTag": true,
    "createdAt": "Fri Feb 26 15:55:45 +0000 2010",
    "entities": {
      "description": {
        "urls": []
      },
      "url": {
        "urls": [
          {
            "display_url": "linktr.ee/Efiglobal",
            "expanded_url": "http://linktr.ee/Efiglobal",
            "url": "https://t.co/mcvLlgxT89",
            "indices": [
              0,
              23
            ]
          }
        ]
      }
    },
    "fastFollowersCount": 0,
    "favouritesCount": 33854,
    "hasCustomTimelines": true,
    "isTranslator": false,
    "mediaCount": 14795,
    "statusesCount": 54411,
    "withheldInCountries": [],
    "affiliatesHighlightedLabel": {},
    "possiblySensitive": false,
    "pinnedTweetIds": [],
    "profile_bio": {},
    "isAutomated": false,
    "automatedBy": null
  },
  "extendedEntities": {
    "media": [
      {
        "display_url": "pic.x.com/vMk6ivMq5L",
        "expanded_url": "https://x.com/efipm/status/1998045254298071140/photo/1",
        "id_str": "1998045251550781440",
        "indices": [
          269,
          292
        ],
        "media_key": "3_1998045251550781440",
        "media_url_https": "https://pbs.twimg.com/media/G7p7kffXIAAX6vP.jpg",
        "type": "photo",
        "url": "https://t.co/vMk6ivMq5L",
        "ext_media_availability": {
          "status": "Available"
        },
        "features": {
          "large": {
            "faces": []
          },
          "medium": {
            "faces": []
          },
          "small": {
            "faces": []
          },
          "orig": {
            "faces": []
          }
        },
        "sizes": {
          "large": {
            "h": 900,
            "w": 1600,
            "resize": "fit"
          },
          "medium": {
            "h": 675,
            "w": 1200,
            "resize": "fit"
          },
          "small": {
            "h": 383,
            "w": 680,
            "resize": "fit"
          },
          "thumb": {
            "h": 150,
            "w": 150,
            "resize": "crop"
          }
        },
        "original_info": {
          "height": 900,
          "width": 1600,
          "focus_rects": [
            {
              "x": 0,
              "y": 0,
              "w": 1600,
              "h": 896
            },
            {
              "x": 350,
              "y": 0,
              "w": 900,
              "h": 900
            },
            {
              "x": 406,
              "y": 0,
              "w": 789,
              "h": 900
            },
            {
              "x": 575,
              "y": 0,
              "w": 450,
              "h": 900
            },
            {
              "x": 0,
              "y": 0,
              "w": 1600,
              "h": 900
            }
          ]
        },
        "media_results": {
          "result": {
            "media_key": "3_1998045251550781440"
          }
        }
      }
    ]
  },
  "card": null,
  "place": {},
  "entities": {
    "hashtags": [],
    "symbols": [],
    "urls": [
      {
        "display_url": "ow.ly/VMER50XF5HO",
        "expanded_url": "https://ow.ly/VMER50XF5HO",
        "url": "https://t.co/V34xd5kg10",
        "indices": [
          1253,
          1276
        ]
      }
    ],
    "user_mentions": []
  },
  "quoted_tweet": null,
  "retweeted_tweet": null,
  "article": null
}