The article gets into this where real Americans do job interviews and if they get a job they can keep 30% of the salary and have to pass off the remaining 70%:
> In the IT worker scheme, once someone involved gets an interview, North Koreans use remote-desktop tools to help coach people through the Q&A with a recruiter.
> Aidan Raney, founder of Farnsworth Intelligence, posed as an American willing to help North Koreans to investigate the issue for a client who almost hired a fake engineer. During the course of two video calls with three or four people who all said their names were “Ben,” Raney learned the details. “The Bens” would handle all the upfront work for him—creating a fake LinkedIn profile to verify his new identity for U.S. recruiters, formulating a bio, and sending it out to dozens of job postings with a new Gmail address they set up.
> The Bens even modified Raney’s headshot to a black-and-white photo so it wouldn’t resemble his usual picture, Raney told Fortune. If Raney got a job, he would show up for meetings, like a morning stand-up or scrum, and go about his day while a North Korean engineer handled the workload. Raney would be allowed to keep 30% of the salary but had to transfer 70% to the Bens using crypto, Paypal, or Payoneer.
> “What they were trying to do was use my identity to bypass background checks, and so they wanted this fake persona they created to be extremely close to the real-life version,” said Raney.
> The Bens got Raney an interview, and while it was ongoing, they used a remote-desktop application to set up a notepad on Raney’s screen so they could write out responses to the questions from the interviewer, Raney explained. And it worked: Raney got a verbal offer for a job with a private government contractor that paid $80,000 a year.
> He then had to immediately turn around and tell the company he couldn’t accept the offer and apologize for claiming their time.