Laptop farms: how they work and how to catch one.
A laptop farm lets someone in another country hold a remote job at your company while their company laptop sits in a house in the US. The login is real and every MFA prompt gets approved. Here's how the scheme works, the warning signs the FBI lists, and how to check, all day, that the person you hired is really at the laptop.
What happened in October 2026
On October 13, 2026 the Justice Department announced coordinated actions against North Korean remote IT worker schemes. In Texas, the FBI searched more than 40 homes known or suspected to be operating as laptop farms and seized about 187 laptops and KVM devices. Fourteen people were charged in an Ohio case involving more than 70 US employers in health care, communications, cyber support, retail and manufacturing (Justice Department). The same day, the FBI warned that these workers are using more helpers, and running more, smaller laptop farms so that no single raid takes them all down (FBI).
The money is only part of the risk. The Justice Department says these workers have also stolen company data and extorted employers, and the FBI reports threats against companies after workers were fired.
How a laptop farm works
A borrowed identity
The worker applies with a stolen or rented US identity, often with help from someone who interviews or appears on camera for them.The laptop ships to a helper
Your company sends the laptop to the address on file. A paid helper, often someone in financial trouble, receives it.Remote control is set up
The helper installs remote-control software or plugs in KVM-over-IP hardware, so the laptop can be driven from abroad.It looks like normal work
The laptop runs on a US home connection. The worker signs in with real credentials and approves every prompt.That's why the usual controls miss it. Passwords, MFA codes, push approvals and passkeys all prove that the person signing in holds the right credentials. None of them asks where that person is, or whether the laptop is being driven from somewhere else.
The warning signs, and which ones software can see
The FBI says no single indicator identifies these workers; each sign is often innocent on its own and matters in combination. Here are the signs it lists, and where you'd see each one.
| Warning sign | Where you'd see it | Can NearAuth.ai see it? |
|---|---|---|
| Remote-control software on the work laptop (AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop) | Endpoint tools, NearAuth.ai | Yes, on Windows: Remote Desktop sessions can trigger approval or a block; running tools are logged. Mac in progress. |
| KVM-over-IP hardware (PiKVM, TinyPilot, GL.iNet) or a second computer driving the laptop | USB device inventory, endpoint tools, a physical check | No. It looks like a real keyboard and screen to any software. |
| The employee's own phone is never near the laptop | NearAuth.ai | Yes. This is the core check, all day. |
| The laptop works from somewhere other than the employee's address | Sign-in logs, NearAuth.ai | Partly: every check records the computer's IP address and approximate location, to compare with the address on file. |
| Software unrelated to the job, such as OBS Studio with VDO.Ninja | Endpoint tools | No |
| Frequent changes to bank accounts, addresses or social accounts | HR and payroll | No |
| Forged or borrowed identity documents | Hiring and background checks | No |
What NearAuth.ai adds
NearAuth.ai checks, all day, that each employee's own phone is next to their own company laptop, and it flags remote control. For a laptop farm, that changes the economics:
- A phone has to live beside every laptop. If the worker abroad keeps the enrolled phone, the laptop in the US never sees it and stops being trusted. The phone's key is held in its secure hardware, and Apple or Google confirms it's a genuine phone running our app, so it can't be faked with an emulator.
- Remote control gets noticed. On Windows, Remote Desktop and Citrix sessions are reported, and your company chooses to log them, ask the owner to approve on their phone, or block. Remote-control tools that are running are logged.
- A record of who was at which computer. Every check is logged with the computer, the second it happened, and its IP address, so a laptop that's always online from an unexpected place stands out, and investigators have evidence when they need it.
Start in log-only mode, so nobody is blocked while you see what turns up. NearAuth.ai works with Google Workspace, Microsoft 365 and Entra ID, on iPhone, Android, Mac and Windows. More on verifying remote employees and continuous authentication.
Honest limits
NearAuth.ai doesn't check identities at hiring, and it can't see a hardware KVM. A determined helper can keep a phone beside each laptop all day. What it does is make a farmed laptop more expensive and noisier to run, and leave a record. Pair it with the steps below.
A checklist for IT and HR
- Verify identity live. Use E-Verify, ask for a US passport or several documents, and verify on a live video call. The FBI notes that live checks add friction, and that helpers sometimes appear on camera, so compare the person on camera with the documents.
- Enroll the phone on that call. If you use NearAuth.ai, have the new hire pair their phone while you watch, so the phone that has to sit beside the laptop belongs to the person you verified.
- Ship only to a verified address, and be wary of last-minute address changes or requests to send the laptop somewhere else.
- Look for remote control. Inventory USB devices for KVM hardware, and alert on remote-access and remote-management tools that your company doesn't use.
- Compare where laptops work from with where employees say they live, and watch for several employees' laptops on the same connection.
- Get HR, payroll, IT and security talking. Bank-account churn in payroll and a remote tool on the laptop mean more together than either does alone.
- Have a plan before you act. If you suspect a worker, involve legal, preserve logs, and report to your FBI field office or ic3.gov before confronting them.
Privacy by design
No keystrokes, screenshots, GPS tracking or biometric data. Locations come from the computer's IP address only. Fingerprint and face checks stay on the phone. See exactly what we collect.
Frequently asked questions
What is a laptop farm?
A laptop farm is a home, usually in the US, where a paid helper keeps company laptops switched on and connected for remote workers who are somewhere else. Employers ship the laptop to the address the new hire gave them; the helper plugs it in and sets it up so the real worker can control it from abroad. To the employer, the laptop appears to be working from an ordinary US home internet connection.
How can we tell if we've hired a North Korean IT worker?
There is no single tell. The FBI says these workers can't be identified reliably with one indicator and recommends layering checks across hiring and employment. Signals worth combining include remote-control software or KVM-over-IP hardware on the work laptop, a laptop that works from an address other than the employee's, frequent changes to bank accounts or addresses, and identity documents that don't hold up.
Can MFA or passkeys stop a laptop farm?
No. The worker has a real account, a real laptop and approves every prompt. MFA and passkeys prove that the person signing in holds the right credentials; they say nothing about where that person is or whether the laptop is being controlled from another country.
Can NearAuth.ai detect KVM-over-IP devices such as PiKVM or TinyPilot?
No. A hardware KVM plugs into the laptop like a keyboard and monitor, and no software on the laptop can reliably tell it apart from a real one. What NearAuth.ai adds is that the employee's enrolled phone still has to be beside that laptop all day, so a farm has to keep a phone at every laptop. Use your endpoint tools and a USB device inventory to look for KVM hardware.
Does NearAuth.ai detect remote-control software?
On Windows, yes. The NearAuth.ai app reports Remote Desktop and Citrix sessions, which your company can set to log, ask for phone approval or block, and it logs when remote-control tools such as AnyDesk, TeamViewer, RustDesk or Chrome Remote Desktop are running. Mac support is in progress.
What should we do if we think we've found one?
Involve your legal team and contact your local FBI field office or file a report at ic3.gov before you confront the worker. The FBI reports that some workers have threatened to leak company data or demanded payment after being fired, so preserve logs and plan how you will remove access before you act.
Does this mean tracking employees' locations?
No GPS tracking. NearAuth.ai learns whether an employee's phone is near their computer and the computer's public IP address, which gives an approximate location. It never collects keystrokes, screenshots, passwords or biometric data.
How much does it cost?
The Essential plan is free for up to 12 users, with no credit card. Advanced is $6 and Enterprise $9 per user per month.
Sources
- US Department of Justice, Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies, October 13, 2026. The charges are allegations.
- FBI, North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment (I-101326-PSA), October 13, 2026.
- Related reading: Meet TraderTraitor, the North Korean hackers behind the Binance heist, and insider threats that use legitimate logins.
Try it
Free for up to 12 people, no credit card. Most teams have their first five people running in about 15 minutes. For a larger team, book a 15-minute demo.
Updated November 7, 2026 • Christopher McLain, founder • chris@nearauth.ai • 607-238-3533