A tiny lag in keyboard strokes exposed a North Korean operative who infiltrated Amazon’s corporate network through a contractor.
Amazon Chief Security Officer Stephen Schmidt revealed the discovery at a company security event in New York City this week, Bloomberg reported. Keystroke data from the worker’s laptop should have taken tens of milliseconds to reach Seattle headquarters. Instead, the delay exceeded 110 milliseconds.
“If we hadn’t been looking for the DPRK workers, we would not have found them,” Schmidt told Bloomberg.
The imposter was hired by an Amazon contractor and received a company laptop. Amazon security staff detected unusual behavior on the machine and found it was being remotely controlled. They traced the traffic back to China. (RELATED: North Korea Has Been Quietly Stealing US Jobs For Years. It’s Made A Killing In The Process)
“A North Korean imposter was uncovered, working as a sysadmin at Amazon U.S., after their keystroke input lag raised suspicions with security specialists at the online retail giant. Normally, a U.S.-based remote worker’s computer would send keystroke data within tens of…
— Ben Casnocha (@bencasnocha) December 19, 2025
Schmidt said the laptop didn’t have access to “anything interesting,” so his team observed the imposter before acting. When they reviewed the application and resume submitted to the contractor, the scheme became clear.
“This looks like somebody who had used the same playbook as other North Koreans that we’ve seen to get this job,” Schmidt said.
An Amazon spokesperson confirmed the person facilitating the scheme was an Arizona woman sentenced to prison in July for helping fraudulent IT workers.
Since April 2024, Amazon has foiled more than 1,800 North Korean hiring attempts. The company reports these attempts have increased 27% on average from quarter to quarter this year.
North Korean operatives pose as remote IT workers to raise money for the regime and its weapons programs. Schmidt said the imposters often claim degrees from the same schools and list jobs at overseas consulting firms that are difficult to verify from the United States.