Okta Threat Intelligence examines DPRK IT-worker fraud through two tracked personas drawn from a larger dataset of more than 130 actors and 6,500 interviews across 500 companies. The examples show actors using free webmail accounts, job and coding platforms, fabricated resumes, VoIP numbers, stolen identities, and co-opted or misrepresented LinkedIn profiles to pass recruiting and reference checks. One persona repeatedly interviewed across AI and healthcare roles, while another likely obtained software-development positions and targeted organizations in aviation, communications, internet services, voting technology, intelligence, and defense. The report is important for defenders because it translates DPRK revenue-generation activity into concrete identity-verification, hiring, and access-control failure modes.