A software developer named 'Denys Emil L.' claimed Danish citizenship and applied via LinkedIn. Documents looked professional — but Scaut's analysts found they were AI-generated fakes. He had borrowed a real Danish citizen's identity and trade license. Investigation revealed a Chinese national systematically targeting multiple Western tech companies simultaneously, later linked to a North Korean-affiliated group.

KnowBe4 — a company that trains organizations on cybersecurity — inadvertently hired a North Korean IT worker. He passed background checks, conducted professional interviews, and received a company laptop. Within minutes of receiving it, he attempted to load malware onto the corporate workstation. Security systems detected the suspicious activity before damage occurred. The incident became a landmark case study in the threat.

Christina Chapman, 50, operated 90 company-issued laptops at her Arizona home — all received on behalf of North Korean workers. She installed remote access software so operatives overseas could work as if in the US. Result: 309 fraudulent hires across major US companies, $17.1M in illicit revenue. Nearly 70 Americans had their identities stolen. Nike confirmed it was among the victims. Chapman received an 8.5-year prison sentence.

Czech IT recruiters documented a consistent pattern: perfect resumes, flawless written communication, then on video calls — cameras 'malfunctioning', multiple voices in background, IP addresses showing Asian locations despite EU residence claims. When confronted, candidates immediately disconnected and never responded again. In 9 of 10 such cases, the candidate vanished. CrowdStrike has since confirmed laptop farms in Romania and Poland.

A major German energy operator (classified under EU CER Directive and KRITIS) discovered an IT contractor had gained privileged access to operational technology systems. The contractor, claiming credentials from Eastern European firms, was later identified as a fraudulent operative. The breach triggered mandatory incident reporting under NIS2 and German KRITIS regulations, and exposed vulnerabilities in third-party contractor screening policies.

A database administrator hired by NHS pathology contractor Synnovis — serving major London hospitals — spent six months systematically exfiltrating 4.2 million patient records: medical histories, mental health assessments, genetic test results. The breach directly contributed to a ransomware attack that disrupted services across multiple NHS facilities. The operative claimed British citizenship with flawless documentation.

A senior developer at a Warsaw financial firm worked for 8 months before his scheme was uncovered: he had embedded code that rounded down wire transfers by fractions of a cent, diverting the difference to cryptocurrency wallets. Over 8 months, €840,000 was siphoned. His Polish citizenship documents and claimed employment history at Estonian and Lithuanian banks were entirely AI-fabricated. Polish regulators used the case to push for enhanced personnel security in finance.