US startup created by researchers deepfake video — Oct 2026

Researchers investigating state-sponsored threat actors established a fake US startup to observe the tactics used by fraudulent North Korean IT workers. By creating a realistic interview pipeline, the team was able to monitor how these individuals attempted to infiltrate organizations to secure W-2 salaries for the DPRK regime.

What happened

The investigation revealed that the threat actors employed a sophisticated combination of identity fabrication and technical deception to bypass hiring processes. To mask their true locations in China or Russia, the workers utilized VPN and proxy chains. During the interview phase, they relied on stolen US identities and deployed deepfake technology to impersonate American citizens on video calls.

Beyond the use of deepfakes, the researchers identified several operational security gaps. The applicants frequently reused specific phrasing in their cover letters and struggled to answer fundamental questions regarding the startup's fake technology stack. The primary objective of these operations was financial, aiming to generate steady income to fund the DPRK while bypassing international sanctions. The researchers noted that these actors often maintained their employment for months before attempting to exfiltrate source code or deploy ransomware. This study highlights the critical need for rigorous verification processes, such as mandatory, unscheduled video calls and thorough background checks, to defend against state-sponsored employment fraud.