From Deepfakes to Stand-In Interviews

North Korean IT workers have been identified using stolen identities and deepfake technology to infiltrate private companies in South Korea and the United States. These actors leverage these deceptive methods to secure remote employment, turning the standard hiring process into a significant security vulnerability for organizations.

What happened

The incidents involve North Korean IT workers posing as legitimate job seekers to gain unauthorized access to private firms. In South Korea, allegations surfaced regarding workers who deceived employers about their identities to perform actual development work, leading to an investigation by local police. Similar cases have been uncovered in the United States, where individuals have stolen the identities of others and utilized remote-access technology to land positions under false pretenses.

These bad actors employ a range of sophisticated tactics to bypass traditional screening, including the use of AI-generated deepfakes to forge faces during video interviews and the use of stand-ins to participate in interviews on their behalf. The prevalence of these threats has forced companies to reconsider their hiring security, as the risk extends beyond the initial application phase to the entire duration of a worker's tenure. The shift toward remote work has made it increasingly difficult for HR departments to confirm whether a candidate is a real person or an AI-generated fake, prompting a move toward more rigorous, continuous identity verification procedures.