AI Series: DPRK AI-Deepfake Fraudulent IT-Worker Onboarding (Wagemole Pattern)
Detects anomalous remote access patterns on a single endpoint, specifically involving AnyDesk or TeamViewer sessions originating from multiple distinct geographical locations combined with usage by multiple distinct user accounts. This pattern is consistent with DPRK IT worker fraud (Wagemole) involving shared laptop farms.
YARA-L
