North Korea’s unexpected weapon: women watching Friends
North Koreans weaponize “made in America” staples – Friends and ChatGPT – to attack Americans.
Friends pilot episode. Courtesy of Friends via YouTube/Illustration by Cybernews.
Follow us
- A researcher says a North Korean IT cell uses women to front fake developer candidates in interviews.
- The cell allegedly builds profiles with stolen data, ChatGPT prompts, practice tools, and Friends transcripts.
- One workbook held about 1,200 female personas, while another tab included data on three American women.
- US firm MageHire is alleged to be a front company; Cybernews has asked it for comment.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
In a change of tactic, a North Korean fake IT cell is using women with limited technical knowlege to pose as software developers to trick western companies into giving them jobs.
The women act as the ‘face’ of the candidate – attending interviews and client meetings on camera – and are then backed off-screen by the developers, who do the technical work.
The playbook includes AI-written profile prompts and anti-detect browsers to proxies, VoIP verification, and bulk account quotas, but also thrown in is the pilot episode of US sitcom Friends, to help with conversational English.
Female recruits become the face of the operation
While Pyongyang’s overseas IT worker schemes are well documented, Hayden McKenzie, an independent researcher specializing in North Korean cells, said this one was unusual for its focus on women.
The approach may reflect an attempt to evade growing scrutiny of Democratic People's Republic of Korea (DPRK) operatives, who are largely male, while also exploiting demand from tech firms seeking more female developers.
McKenzie accessed the group last year through social engineering after receiving invitations to 2 English-speaking Slack workspaces used by the operation.
Women are placed as callers, sent to interviews and client meetings on camera, and backed off screen by the developers who do the technical work,- claims North Korea threat researcher Hayden McKenzie.
Researcher tracks DPRK female recruit
In his blog, the researcher asserts there are multiple female trainees and trainers within the cell and followed one recruit who adopted the identity “Jasmine Bell.”
Jasmine arrived with little technical or interview experience but was recruited in part for her spoken English.
Within days, she was given an identity and put to work creating email accounts and LinkedIn profiles.
She was also tasked with developing identities specifically for women.
One shared workbook contained roughly 1,200 prospective female identities “personas,” all born between 1995 and 1998.
Fake resumes, AI interview coaching, and Friends scripts
According to McKenzie’s observations, the cell combined identity fraud with AI tools to present North Korean operatives as legitimate remote workers.
Jasmine was instructed to build a convincing online persona using real addresses and plausible job histories.
She registered more than 20 Outlook accounts through a single Gmail account before Microsoft introduced phone verification.
Real information appears to be mixed with stolen data, as McKenzie spots a tab labeled “US_Real” containing the dates of birth, ID numbers, home addresses, bank account details, and credit score histories of 3 real American women, 2 of whom are based in Florida.
When a client requested a systems administrator position, her resume was tailored to the role. ChatGPT was used to generate a biography, university background, a Florida address, and an interview introduction.
The worker used the AI interview platform MockWise to practice before a real client call, with 3 cell members assisting behind the scenes.
To brush up on her English, Jasmine could access transcripts of the US sitcom Friends, with 6 early episodes posted in the operation’s Slack channel in March 2025.
The sample McKenzie shares in his blog came from the pilot episode, The One Where Monica Gets a Roommate,” a scene where Rachel cuts up her credit cards.
A US-facing company acts as a front
McKenzie claims that the cell’s US-facing activities ran through MageHire, a New York-based software and AI services company aimed at fast-scaling tech startups.
The researcher assesses “with high confidence” that MageHire is a front for the cell and that its CEO, US citizen Schmid Payen, knowingly facilitated placements.
When Jasmine’s first interview failed – the client felt her CV was too precise, and her background didn’t check out and 2 previous candidates had no experience in using the Auth0 access manager – Payen was on hand to provide answers, successfully persuading these busy startup companies to persevere with even more recruits.
Its US-based CEO holds the client relationships, signs the client's device attestation forms, and once the fraudulent candidate had been caught, wrote explanations that helped keep the account and scoped more work on top of it,– alleges Hayden McKenzie, North Korea threat researcher.
Cybernews has contacted MageHire for comment.
Researcher poses as client, interviews Jasmine
McKenzie eventually went a step further, posing as a prospective employer. He contacted Jasmine and offered her an interview, using names familiar to her to help establish trust.
Professing a love of reading the Harry Potter and the Twilight series, Jasmine continued to describe herself using elements of her constructed persona, including a supposed move from Singapore to Florida.
Jasmine's English isn't bad, her acting and timing are not as good as Jennifer Aniston's and it's pretty obvious she's reading from a script.
McKenzie reported long pauses, unclear answers, and voices audible in the room around her.
“After asking whether she'd be interested in pursuing a hybrid role as opposed to a virtual one, she repeatedly mentioned her introversion and expressed interest in remote roles exclusively,” the researcher noted.
Ready-made fraud toolkit
The researcher said that what Jasmine was handed was a ready-made fraud toolkit, from AI-written profile prompts and anti-detect browsers to proxies, VoIP verification, and bulk account quotas.
Within 3 weeks, she had been equipped for a live client interview, with AI-generated application materials, MockWise rehearsal, and 3 colleagues coaching off-screen.
“What Jasmine received is not just instruction, but tooling advice.”
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Women are increasingly being recruited into criminal cyber operations, researchers have reported.
By posing as recruiters and infiltrating developers’ systems through fake job interviews, North Korean operatives can do far more than steal a salary.
Earlier this month, authorities said a group named WaterPlum, also commonly known as Contagious Interview, compromised more than 30,000 devices, breached over 7,000 cryptocurrency wallets, and funneled at least $10.71 million in stolen crypto to Pyongyang.
