Local Laptops, Remote Workers: Recruiting Fraud Partners

Recruitment roles and revenue shares

Both domains use the name “Development Partners” and claim that an established Asian software team needs local infrastructure and a domestic presence for clients in North America and elsewhere. Their service pages list four paid roles:

• Host a laptop (5-10%): keep a physical laptop powered on and connected at home while the team accesses it remotely.
• Attend client interviews (+20%): appear on discovery calls and use supplied talking points.
• Manage client communication (+20%): handle a small amount of email and scheduling.
• Lend a freelance account (+20%): provide a verified marketplace profile for the remote operators to use.

Recruits who take every role are promised up to half of the contract revenue. The requirements emphasise location and willingness to participate, not technical experience. Preference is given to native English speakers in the United States, United Kingdom, and Brazil.

The advertised process allows 8-48 hours for a reply, followed by a short screening call, activation within a week, and payment within 30 days. No skills test, portfolio review, or background check is mentioned.

Residential access and local identities

When a remote operator connects through a laptop on a residential network, the resulting activity appears to come from the host’s location. A local freelance profile provides verified identity and tax details, while a local speaker can attend interviews in place of the operator.

FBI, CISA, and Department of Justice advisories describe the same combination of residential laptops, borrowed identities, and interview stand-ins in North Korean IT worker operations. While no definitive link to the DPRK can be made from the evidence observed, the tactics align closely with documented DPRK laptop-farming activities.

Shared code and design

The captured homepages use the same Development Partners messaging, navigation, visitor-growth section, and section order. Their static JavaScript runtime, main, and framework chunks are identical, while their Next.js build IDs differ. Both were registered through Hostinger and served through Vercel edge infrastructure.

Feature	Solistra	Axiomora
Framework	Next.js static export	Next.js static export
Core JavaScript	Identical shared runtime chunks	Identical shared runtime chunks
Background media	Shared video set	Shared video set
Visible chatbot	Present	Not observed
AI request path	Browser-side OpenAI request	Internal /api/chat route
Management page	No staff listed	Synthetic-looking avatars and browser-side access controls

Only Solistra displayed a chatbot. Both sites contained AI request paths: Solistra called OpenAI directly from the browser, while Axiomora used an internal /api/chat route. Solistra’s frontend bundle also exposed the API key used for those requests.

Axiomora staff profiles

Both sites use synthetic-looking office scenes and testimonial portraits. Axiomora also lists four managers with synthetic-looking headshots.

Each profile is password-gated. The site does not explain how a candidate should obtain a password, yet all four passwords are hardcoded in the page JavaScript. Anyone who inspects the code can recover them. The profiles supply WhatsApp numbers for all four managers and Discord handles for three.

This broken flow points to poor AI-assisted development and little or no user testing. The sites may have been generated and deployed with little human review.

Reused video files

Both sites use background videos with the same filenames. The footage is obviously AI-generated and shows a woman pointing at an animated version of each site’s logo.

Difference from fake-interview malware

This differs from fake-interview malware campaigns, where a job applicant is tricked into running malicious code. Solistra and Axiomora tell recruits that they will host a device, attend calls, or lend an account. The client or freelance platform is the intended target of the deception.

Indicators of compromise

While no malicious code was identified at the time these sites were analysed, they should not be treated as safe.

The sites published the following domains, email addresses, Discord handles, and WhatsApp numbers.

Type	Value	Listed identity
Domain	solistra[.]tech	Solistra
Domain	axiomora[.]tech	Axiomora
Email	hello@solistra[.]tech	Solistra
Email	hello@axiomora[.]tech	Axiomora
Discord	doncherry330	“Don Cherry”
Discord	johncarlo99999	“John Carlo Bautista”
Discord	fujita88888	“Ken Tanaka”
WhatsApp	+63 (995) 582-3552	“Henry Lee”
WhatsApp	+1 (782) 914-2097	“Don Cherry”
WhatsApp	+63 975 350 3645	“John Carlo Bautista”
WhatsApp	+81 90-7048-8448	“Ken Tanaka”