Security Alliance reports that DPRK-linked IT workers have expanded from seeking fraudulent employment into recruiter-style operations that enlist collaborators on platforms such as Upwork, Freelancer, Fiverr, and RandstadUSA. The observed workflow uses scripted outreach, verified or proxy identities, account-registration guidance, identity-verification steps, credential sharing, and movement to Telegram, Discord, or email. In multiple cases, targets surrendered full access to freelance accounts or installed remote-access tools such as AnyDesk or Chrome Remote Desktop, letting operators work under the victim’s verified identity and IP address. Documents, presentations, Korean-language materials, and monitored profiles suggest a repeatable shared methodology, though the excerpt does not determine whether recruiters are a distinct role or IT workers adapting their tactics. This evolution matters because it scales DPRK revenue-generation activity while helping actors bypass platform verification and reduce direct exposure.