On 6 March 2026, Microsoft Threat Intelligence published *AI as tradecraft: How threat actors operationalize AI*, a report arguing that AI has become an operational layer running underneath intrusions rather than an experiment bolted onto them. Its case study is North Korean remote IT worker activity, tracked by Microsoft as Jasper Sleet and Coral Sleet (formerly Storm-1877): people hired into real engineering jobs on fabricated identities who keep the job and access with language models. The report names no victim company, no stolen-record count and no compromised system; its only scale figure is that Microsoft "identified and disrupted thousands of accounts associated with fraudulent IT worker activity," with no country, date range or employer attached. Microsoft says Jasper Sleet "leverages AI across the attack lifecycle to get hired, stay hired, and misuse access at scale." Actors read job listings to extract role-specific language, responsibilities and qualifications, identify in-demand certifications and tools, and research target-industry platforms and workflows. Quoted prompts include "Create a list of 100 Greek names" and "Create a list of email address formats using the name Jane Doe"; tools wrote résumés and cover letters and produced fake developer portfolios, with personas reused across multiple applications and platforms. Microsoft says Jasper Sleet used the application Faceswap to insert North Korean IT workers' faces into stolen identity documents and generate headshots, in some cases reusing one AI-generated photo across several personas with slight variations, and voice-changing software to mask