How Amazon’s CSO defends against efforts by North Korean IT workers to infiltrate his company

Amazon chief security officer Steve Schmidt says his team has identified and blocked more than 1,800 attempts by North Korea to secure IT roles, with a 27% quarter-over-quarter rise in such applications in 2025; notable cases include four North Korean nationals charged in an alleged scheme to steal nearly $1 million in cryptocurrency and a U.S.-based conspirator sentenced for a $17 million identity-theft ring. Schmidt warned nation-state actors are increasingly targeting high-paying AI/ML jobs for both financial gain and access to proprietary data, evolving from fabricated profiles to purchasing legitimate U.S. identities and using AI as an attack tool. Amazon is responding with AI-enabled detection, tighter identity verification, in-person interviews, and its Midway authentication system using physical U2F keys, underscoring growing hiring-security friction across tech and the need for coordinated HR-security defenses industrywide.

Analysis

Amazon chief security officer Steve Schmidt reported that Amazon has identified and blocked more than 1,800 attempts by North Korea to secure IT roles, and that such applications rose 27% quarter-over-quarter in 2025; notable enforcement examples cited include four North Korean nationals charged in an alleged scheme to steal nearly $1 million in cryptocurrency and a U.S. conspirator sentenced to eight years for a $17 million identity-theft ring. The article documents an escalation in tactics: actors have evolved from fabricated online profiles to purchasing legitimate U.S. identities and creating fake job-application platforms to target high-paying AI/ML roles and access proprietary data. Amazon is deploying a mixed defense of AI-enabled detection and human controls—training models to flag resume anomalies (e.g., a leading plus sign in phone numbers, ~200 suspect academic institutions, fictitious employers), increasing in-person interviews, instituting multi-stage identity checks, and using its Midway authentication with Universal 2nd Factor physical keys. The broader market context shows rising security costs and hiring frictions for tech firms, reported pressure on AI-exposed stocks (CoreWeave’s $33 billion market cap decline cited) and regulatory noise around AI, implying that firms demonstrating effective identity and agent governance reduce operational and reputational risk amid a moderately negative, defensive sentiment backdrop.

Key Decisions for Investors

• Favor companies that can demonstrate hardened identity and access controls (example: Amazon’s Midway/U2F approach) as these reduce breach and insider-risk exposure and may preserve enterprise value
• Monitor quarterly spending and execution on AI-security programs at large AI spenders (Broadcom, Oracle, CoreWeave cited) and consider trimming positions where heavy AI capex is not paired with clear security or ROI milestones
• Increase selective exposure to cybersecurity vendors and services providers that will benefit from heightened enterprise hiring and identity-verification demand, while avoiding vendors tied to speculative AI infrastructure without proven profitability
• Track regulatory developments (U.S. executive action, state AG letters, EU probes) and remote-hiring policies as triggers for reevaluating valuations and operational risk premia in technology portfolios