JOHN YANG: This week federal prosecutors charged four North Korean nationals with scheming to get hired by a U.S. company as remote workers and then steal nearly $1 million in cryptocurrency.

It's a relatively new North Korean threat, operatives using fake IDs and credentials to infiltrate American businesses.

Freelance investigative reporter Bobbie Johnson explained how and why they're doing it in a Wired magazine article headlined North Korea stole your job.

Bobbie, it's more than jobs that North Korea is after.

Why are they doing this?

BOBBIE JOHNSON, Freelance Investigative Journalist: So the reason for this scam is really to earn money from well compensated jobs in the U.S. and in the west and send it straight back to Kim Jong Un and his regime to fund various things from the nuclear weapons program to his personal slush fund and other government operations.

North Korea is really under pressure because of sanctions, so they can't make money through normal means, but really they also access computer systems, steal data to potentially plant malware or other dangerous software so that they can in the future do ransomware attacks, as we've seen in the past.

JOHN YANG: And what kind of jobs are we talking about and what kind of companies?

BOBBIE JOHNSON: As we all saw from the pandemic, a lot of jobs went remote, but one of the widest ranging is software engineering.

And so this is a place where people are very used to, over a long period of time, for hiring remote workers who get the job done.

They're coding websites, they're building apps, they're making, kind of doing all the IT and technical stuff.

And so these are really the target jobs for these operatives in job interviews.

JOHN YANG: How do these guys disguise who they really are and where they really are?

BOBBIE JOHNSON: Yeah, so we'll go through the scam a little bit.

So what they do is, first of all, they steal an identity so they get hold of someone's ID, their personal details, their Social Security number they make a resume up that says, you know, they know how to do this, they know how to do that, they know how to code websites, whatever it is that the jobs are requiring.

They'll then get on to an interview, talking over a video like this.

They'll use all manner of tools at their disposal to try and pass that interview.

So they will have an AI that generates a script for them.

So the interviewer asks a question, the AI is listening.

It will create a script that the person can then read back and sound relatively fluent or knowledgeable.

And particularly help them get over their difficulties with English.

Because these North Korean operatives, although they've been trained, they're not native English speakers, and they're not kind of who they say they are.

So they're trying to pretend.

But they'll also do stuff like if they're asked to do software tests or coding tests, they'll use AI or programmatic tools to kind of cheat those tests and look like they're better than they are.

And then when they get the job, that's when things get even more complicated and they have to bring in other people to help them succeed.

JOHN YANG: And help.

They need help on the state side, don't they?

There are all sorts of federal forms that have to be filled out and signed.

BOBBIE JOHNSON: So they're based usually in China or Russia, and they are kind of dialing in remotely to these jobs.

But that's a real red flag for folks, right?

So what they do instead is they kind of have a middleman who based in the U.S. maybe somewhere like Arizona or Minnesota or Illinois.

And they're just in an ordinary home.

But what they do is they kind of act as the point person.

And so they'll be filling out the forms.

They'll be opening or holding bank accounts that monies are being paid into that they can then disperse back to the North Koreans.

And crucially, what they do is they host what's known as a laptop farm.

So when an employer brings someone on, they'll send them a computer.

Here's your computer to do your work on.

What happens is that computer gets sent to the middleman, not to the North Korean, gets sent to the middleman, set up in their home, where they install tools that allow the North Korean to dial in from China or Russia into that laptop, and then kind of leapfrog and piggyback its way to the company's computer network.

So it never appears that they're dialing in from outside the country.

JOHN YANG: How big a problem is this?

And how long has it been going on?

BOBBIE JOHNSON: The size and scale of this is really one of the questions that is hardest to answer.

There are up to a dozen cases making their way through the U.S. courts at the moment.

But the real problem here, I think, is that nobody really knows the full extent.

So each of those cases is linked to maybe to dozens or even hundreds of different jobs that North Koreans are doing in the U.S. and that's just the tip of the iceberg.

So there could be many more.

JOHN YANG: These American helpers that you talked about, how do they get involved?

How are they recruited?

BOBBIE JOHNSON: This is one of the things that I think is hardest to know in some cases.

So they get maybe a message on LinkedIn or on social media or an email to them that asks them, somebody posing as a foreign company who needs some help.

It's unclear that at the beginning, the facilitators know that they're really taking part in a criminal action.

But by the time they are operating maybe 50, 60 laptops from their home and they're allowing people to dial in and they're sending money to China, it's very clear that they are deep in the criminal conspiracy.

JOHN YANG: Bobbie Johnson, freelance investigative reporter.

Thank you very much.

BOBBIE JOHNSON: Thanks for having me.