Ledger / 30 Jun 2025
Microsoft: Jasper Sleet uses Faceswap and voice changers for fake IT workers
Confirmed
Microsoft Threat Intelligence names Faceswap and voice-changing software.
Since 2024 the workers used AI to swap faces into stolen identity documents and make headshots, and voice changers in interviews. A March 2026 Microsoft report describes AI use at every stage of hiring.
“use AI tools like Faceswap to move their pictures over to the stolen employment and identity documents”Microsoft
Sources
- Jasper Sleet: North Korean remote IT workers' evolving tacticsMicrosoft · 30 Jun 2025 · primary source
- AI as tradecraft: How threat actors operationalize AIMicrosoft · 6 Mar 2026 · primary source
- Disclosed
- 30 Jun 2025
- Activity
- 2024
- Actor
- Jasper Sleet (and Coral Sleet) (nation state), as attributed by Microsoft
- Nexus
- North Korea
- Targets
- Western employers hiring remote IT staff
- What the AI did
- Social engineering, Deepfake, Fraud
- Model
- Faceswap, unspecified voice-changing software
- Model family
- Deepfake / voice
- Model basis
- stated by researcher
- Autonomy
- assist
- Outcome
- Microsoft suspended about 3,000 related accounts.