Microsoft Threat Intelligence (Microsoft Security Blog)
Jasper Sleet abuse of Workday Recruiting Web Service / career sites · 2026-04-21T16:03:09+00:00 (published_time)
Threat actors such as Jasper Sleet, a North Korea-aligned threat actor, exploit this model by posing as legitimate hires using stolen or fabricated identities and AI-assisted deception to gain trusted access, generate revenue, and in some cases enable data theft, extortion, or follow-on compromise. ... In the pre-recruitment phase, Microsoft has observed Jasper Sleet accessing Workday Recruiting Web Service endpoints exposed through external career sites from known actor infrastructure and email accounts