Nicole Perlroth has knocked on a lot of doors. But this one was different.
This one required a security detail armed with a Glock 17.
Standing in ankle-deep snow outside a squat brick house in Cincinnati, she and her producer were about to meet the human infrastructure behind North Korea's IT worker machine: an American "facilitator." The woman who eventually shuffled down the stairs was a 21 year old named Lexi, dressed in a Hello Kitty T-shirt and pajama shorts. She'd been napping. Her grandfather, whose own father fought in the Korean War, came down behind her.
Neither of them fully understood what they'd gotten into. That's exactly the point.
The Missing Link in North Korea's Scheme
The first two episodes of To Catch a Thief explored how North Korean IT workers infiltrate American companies using fake identities, AI-polished résumés, and coordinated job application campaigns run from overseas. But the scheme has a logistical problem: North Korea's workers aren't based in the U.S.. They can't receive corporate laptops in Pyongyang. They can't open U.S. bank accounts or maintain LinkedIn profiles that pass HR scrutiny from the inside.
They need Americans to do it for them.
These Americans are the connective tissue between North Korea's overseas workforce and American companies' payroll systems. They receive laptops, plug them in, install remote desktop software, and collect a monthly fee. Some go further: cashing paychecks, setting up bank accounts, renting out their LinkedIn accounts, even showing up for in-person job interviews on behalf of someone who doesn't exist.
Ryan LaSalle, CEO of Nisos, put it plainly: "There are hundreds of Americans who are happy to help them. They call them natives."
Investigators estimate between 75 and 200 laptop farms currently operate across the United States. The people running them are almost never hackers. They're people looking for a side hustle.
A Door in Cincinnati
Lexi's path into this world started on Reddit. She'd posted in forums advertising she'd do anything online for quick cash—drawings, writing, whatever. A recruiter reached out, moved the conversation to Discord, and spent weeks building rapport. He asked about her day, shared his birthday, talked about her dream of being a writer. He called her darling. He sent emojis.
Then, once the relationship was established, he made the ask.
He wanted her to rent him her internet connection and home address. He’d send her a laptop: all she’d have to do is plug it in and download AnyDesk. He’d handle everything else remotely. In return, Lexi would get $100 a month in crypto, sent via PayPal.
Lexi signed up for two laptops. When the first broke, the recruiter pushed her to take more. She knew something wasn’t right, enough to take the precaution of covering the laptop camera with tape. But still she kept the arrangement going because she needed the money. Her grandfather was on disability and she wanted to buy her little sister string lights for her bedroom.
The laptop's login screen read "Dustin Lee," which was a persona with a month’s old a LinkedIn profile that claimed a three-year stint at Accenture (which Accenture has no record of), an AI-generated headshot, a VOIP number, and a bio written by AI.
By the time Nicole Perlroth knocked on Lexi’s door, Lexi had been hosting corporate laptops for North Korean IT workers for months without knowing it. The night after that first knock, she sat down and filed an FBI report. "I'm so young and I haven't really lived my life," she told the team the next morning. "I don't want this money to ruin my life."
How North Korea Recruits Its Facilitators
North Korea's facilitator pipeline is opportunistic and wide. Operatives troll Reddit subreddits where people advertise for gig work or quick cash. They've also recruited off gamer platforms and, according to LaSalle, off adult content sites. The ideal recruit, based on Nisos's analysis of North Korean Discord communications, is a young American looking for passive income. But many facilitators don't fit that profile. What they share is financial pressure.
Chris Wong, a former FBI special agent who spent a decade on North Korea cases, described how the arrangement looks from the inside: "All I do is leave that thing there and it's like passive income. And by the way, a 21-year-old's probably not expecting to be contacted by North Korean IT workers to do that."
The role has evolved. In the scheme's earlier phases, North Korea built its own fake infrastructure—synthetic LinkedIn profiles, stolen Social Security numbers. As companies got better at detecting those patterns, the playbook shifted toward recruiting real Americans to lend their identities. One facilitator tracked by Nisos's clients was a U.S. military veteran who listed "laptop farm" on his résumé and had no idea anything was wrong. Another was collecting $1,000 a month to let a North Korean worker operate under his LinkedIn account.
Willing or Unknowing: The Spectrum of Complicity
Poland-based researcher Black Big Swan has tracked facilitators across multiple countries and estimates roughly half are genuinely unaware they're working on behalf of North Korea. The other half either suspect something or know outright and rationalize it. "They tell themselves a story that they're businessmen," he said. "I'm just giving them access to my PC."
The most cautionary case is Christina Chapman, a woman from Arizona who went from hosting laptops to picking up corporate badges, cashing checks, and running a full-scale operation of 90 machines. When the FBI raided her home in 2023, she was averaging $4,900 a month. She documented parts of the work on TikTok. She pled guilty to conspiracy, identity theft, and money laundering and was sentenced to 8.5 years in federal prison.
This was a very heavy cost for very little return. Indeed, Chapman’s federal public defender Alexis Gardner described the defendant as an unsophisticated lonely person who could easily be taken advantage of. The scheme she enabled generated $17.5 million.
"She made less than $160,000 off the whole thing," Gardner said.
The North Korean regime captures the value and the facilitator absorbs the risk. Just like Lexi back in Cincinnati, who made a hundred dollars a month to host a single corporate laptop—until a journalist showed up at her door.
Listen: To Catch a Thief
Episode 3 of To Catch a Thief closes on a broader argument: this season started as a story about North Korea. It has become a story about America.
The same economic pressures squeezing American families—unemployment, income inequality, isolation, the long tail of pandemic disruption—are the conditions North Korea's operators systematically identify and exploit. The pool of potential facilitators isn't fixed. As AI reshapes the job market and AI-written North Korean résumés compete directly with American workers, the vulnerabilities that made Lexi susceptible are about to reach more people.
Episode 3 of To Catch a Thief, "The Facilitators," is out now. To Catch a Thief is co-produced by Nicole Perlroth and Rubrik, in partnership with Pod People. Follow the show wherever you listen to podcasts.