Remote IT employers deepfake video — Apr 2025

North Korean operatives are increasingly utilizing generative AI and deepfake technology to bypass recruitment filters and impersonate US-based IT workers during remote job interviews. These fraudulent activities are facilitated by intermediaries who help the workers secure positions to generate funds for the North Korean government.

What happened

Research from Okta indicates that facilitators are employing a suite of generative AI tools to streamline the process of obtaining remote IT roles. These tools include services that optimize resumes to pass automated screening systems and platforms that manage multiple communication accounts simultaneously. To prepare for the interview stage, facilitators utilize AI programs that conduct mock interviews and provide performance feedback.

Crucially, these facilitators are using AI-powered deepfakes to mask the identities of the North Korean workers during real-time video calls. HR firms have reported instances of scammers using face-swapping technology to maintain the ruse during live interviews. Once hired, these individuals may steal confidential data from their employers to demand ransom payments. The scale of these operations, supported by automation and generative AI, allows for the exploitation of short-term employment opportunities. Federal investigators have previously arrested US citizens involved in facilitating these schemes, including one individual who operated a laptop farm to help workers appear as though they were based in the United States. In response to these findings, the FBI and cybersecurity vendors are advising companies to implement stricter vetting processes for remote job candidates.