the job that comes with a laptop

In July 2024 KnowBe4, a security awareness company, hired a software engineer. According to the company’s own account, the candidate passed four video interviews, a background check and reference checks. KnowBe4 shipped a Mac. On the evening of 15 July its security tools flagged the new account loading malware, and the team isolated the device about 25 minutes later. The identity was real and stolen, the photo had been edited with AI, and the person typing was, according to KnowBe4, working for North Korea.

KnowBe4 caught it on the first evening. It wrote the case up because most companies would not have. The full case is in the KnowBe4 incident.

This guide is about hiring as an access process. Every new hire receives credentials, a laptop and a set of doors on day one, and day one, already too much covers how wide that bundle usually is. This guide covers the two ways attackers use the hiring process itself: by getting hired, and by pretending to hire your people.

two ways the hiring process is used against you

they apply to you

a fake candidate

• A real, stolen identity passes the background check
• The company laptop goes to an address someone else controls
• Production access arrives with the job, on schedule

they recruit your people

a fake employer

• An engineer gets a generous offer from a company that does not exist
• The test task or the offer document runs on the work laptop
• The attacker gets everything that laptop can reach

the candidate who is someone else

The KnowBe4 case is not unusual. In July 2025, The Record reported, an Arizona woman named Christina Chapman was sentenced to 102 months in prison for running what prosecutors call a laptop farm. According to prosecutors she helped North Korean IT workers get jobs at 309 US companies using 68 stolen identities. Employers shipped laptops to her house, she installed remote access software on them, and the workers connected from abroad. The FBI found more than 90 laptops when it searched her home in October 2023, and she had sent 49 more overseas.

A month earlier, on 30 June 2025, the US Department of Justice said North Korean workers had obtained jobs at more than 100 US companies, and that the FBI had searched 21 suspected laptop farms in 14 states in a single week that June. One indictment alleges that a worker reached the laptop and files of a California defence contractor, including export-controlled data, for more than two months in 2024.

The Justice Department describes the schemes as a way to earn money for the North Korean state. In January 2025 the FBI warned that North Korean IT workers, once discovered, were holding stolen source code and data hostage for ransom, copying company repositories to personal accounts and stealing session cookies.

The pattern that matters for you: the background check confirms that the identity exists. It cannot confirm that the person on the call owns it. And the company laptop works the same for whoever has it open.

the recruiter who is someone else

The other direction is older. In April 2022 the FBI, CISA and the US Treasury described how TraderTraitor, a North Korean group, approaches system administrators, developers and DevOps staff with messages that imitate recruitment and offer high-paying jobs. Three months later The Block reported, citing two people familiar with the matter, that the $540 million theft from the Ronin network behind the game Axie Infinity started with a senior engineer who went through several rounds of interviews for a job at a company that did not exist, then opened the offer as a PDF. Sky Mavis, the company behind the game, has said only that an employee was compromised by spear-phishing. The full case, including a permission nobody revoked, is in the Ronin incident.

Looking at a job offer is a normal thing to do. The engineer did it on the computer in front of them, which happened to be one that could reach production. The laptop that can reach production is the guide for that half of the problem.

Hiring is the one process where you hand a stranger credentials on purpose.

what this looks like at your size

Picture a 120-person company hiring its fourth backend developer, fully remote, through an agency. The candidate’s CV is strong, the interviews go well over video, and the agency’s checks come back clean. IT ships a laptop to the address in the onboarding form, which differs from the one on the CV. Two days before the start date the new hire asks to change the bank account for salary payments.

Each of those details has an innocent explanation. Together they are the list the FBI publishes. And on day one the laptop arrives with the default developer bundle: the code repositories, the cloud console, the deploy pipeline and the support tool with customer data.

what narrows it

See the person once. The FBI recommends doing as much of the hiring and onboarding in person as possible. For a fully remote team that might be one meeting, a visit to an office, or a video call with a manager where the candidate shows the same identity document HR already has. It is the one check a stolen identity cannot pass.

Treat the shipping address as part of identity. KnowBe4 lists a laptop shipping address different from where the person lives or works as a red flag. The FBI adds changes of address or payment details during onboarding. Ask HR and IT to compare the address on the CV, the address on the contract and the address the laptop goes to, and to raise a flag when they differ.

Make the first weeks smaller. A new hire does not need production on day one. Give the starter bundle first and add production access after a few weeks of real work, when someone who has worked with them asks for it. This is good practice for every hire, and it is what limited the damage at KnowBe4, whose new hire, according to the company, had no access to production systems.

Watch for one account with two pairs of hands. The FBI lists remote desktop tools on company laptops and many logins into one account in a short time as signs. Blocking unapproved remote access software on company laptops is usually one setting in a device management tool.

Tell your engineers about the other direction. Job offers that arrive with a test task or a document are where TraderTraitor starts, according to the 2022 advisory. Agree that test tasks and offer documents from unknown employers get opened on a personal machine or a throwaway one, and never on the laptop that can reach production.

the question to take to your team

If someone else had applied under one of your current employees’ names, which step of your hiring process would have noticed? If the honest answer is the first payroll, start with the shipping address.