Last updated: October 27, 2026
North Korean IT workers have used stolen identities, laptop farms and AI face-swapping to pass remote technical interviews at thousands of companies. Okta has tied the scheme to more than 6,500 interviews at over 5,000 companies through mid-2025, and the fix starts with who verifies the person on the call, not which software does.
A hiring manager at a cybersecurity training company sat through four video interviews with a backend developer candidate. Every call went fine. The candidate answered the technical questions well, named real frameworks, sounded like someone who’d actually shipped code before.
He had. For North Korea.
That’s not a freak story anymore. It’s one of more than 6,500 interviews Okta’s threat intelligence team has tracked across 5,000-plus companies through mid-2025. Most of those targets never placed a North Korean operative. Enough did that the FBI, the Justice Department, and most of the identity-verification industry have spent two years building a playbook around it. This is that playbook, scaled down to what an IT staffing or security hiring manager can actually run before the next remote contractor starts.
How Are Fake IT Workers Actually Getting Hired?
Three things, mostly. A stolen or fabricated identity clean enough to pass a background check. A real person physically holding the laptop once it ships, so device telemetry looks domestic. And increasingly, face-swapping software to beat the video interview itself.
The FBI’s January 2025 public service announcement warned that North Korean IT worker networks are using generative AI and face-swapping technology during live video interviews and onboarding calls, not just on resumes. A second PSA from July 2025 covered the other half of the operation: U.S.-based facilitators running what the Bureau calls “laptop farms,” rooms of company-issued devices plugged in, VPN’d to look domestic, and handed off to operators who never set foot in the country.
The Justice Department made the scale visible in June 2025. Coordinated searches hit 21 premises across 14 states in a single operation. Agents seized roughly 137 laptops. More than 100 U.S. companies had unknowingly employed a North Korean IT worker through one of these setups, according to the DOJ’s own announcement. A hundred-plus companies. Not one of them thought they’d hired badly.
Could This Happen to a Company That Does Security for a Living?
It did. KnowBe4, a company that sells security awareness training for a living, hired a software engineer in 2024 who turned out to be a North Korean operative working under a stolen U.S. identity.
He passed four video interviews. He passed a background check. The photo on file matched a real person’s identity documents. It just wasn’t him. The company shipped him a laptop. He logged in. Within minutes the device was doing things a new hire’s laptop shouldn’t: loading unauthorized software, moving files to personal storage, and running a session that didn’t look like anyone’s normal first day.
KnowBe4’s security operations team caught it in about 25 minutes and contained the device before anything left the building. The company’s own writeup says no data was exfiltrated and no systems were compromised. Twenty-five minutes. That’s close to the best-case outcome in this entire category of incident, and it still took a trained SOC watching in real time the moment the laptop connected.
Most companies reading this don’t have that SOC. Most don’t need one, if the person never gets hired in the first place.
What Actually Looks Off in a Remote Interview?
Nothing dramatic, usually. No red flares. The tells are small and technical, not cinematic.
Security researchers at Palo Alto Networks’ Unit 42, who study these overlays directly, point to a specific set of visual artifacts: a hairline that doesn’t move naturally when the candidate turns their head, brief misalignment between the eyes during fast motion, and lip movement that lags half a beat behind the audio. Unit 42’s research also found that a convincing real-time overlay takes about an hour to build, using free consumer tools, and no technical background. An hour. That’s less time than most companies spend reviewing the resume.
Other patterns recruiters report: a candidate who won’t turn the camera to show the room behind them, who sounds noticeably more fluent on the second technical call than the first, as if a different operator is behind the second script, or whose video quality drops right at the moment a harder question lands.
None of that proves anything by itself. Stacked together, on a candidate you’ve never met and may never meet, it’s worth a second look before the offer goes out.
Which Identity Checks Actually Catch This Before Day One?
Four checks do most of the work, and none of them require new software.
Live ID verification on camera beats a photo upload every time. The candidate holds a government ID up to the lens and tilts it while the recruiter watches how light moves across the laminate in real time. A static photo upload is trivially faked. Watching an ID move under real light is a different problem for a fraudster to solve, and most haven’t solved it yet.
Check where the laptop actually ships. If the shipping address doesn’t match the verified ID, or it’s a residential address in a state the candidate swears they’ve never lived in, that’s a laptop-farm pattern, not a quirk in someone’s moving plans.
Then there’s the oldest trick in recruiting, and it still outperforms anything newer. Call a reference yourself. Not a number the candidate hands you, a number you find independently, through LinkedIn or a company switchboard, connected to a manager who actually existed. A fabricated work history rarely survives a real person on the other end of that call saying they’ve never heard of this person.
Meet in person when you can. Simple as that. Not always possible. Still worth trying.
Our own candidate-vetting process builds all three checks in before a resume ever reaches a hiring manager, which is a different sequencing than most background-check vendors use.
Why Is a Recruiter Who Knows the Candidate a Security Control, Not Overhead?
KORE1 partner Devin Hornick puts it bluntly: “A recruiter who actually knows the candidate is now a security control, not overhead.”
That’s coming from someone whose firm sells recruiting, so weigh it accordingly. The logic holds regardless of who’s saying it, though. A background check vendor runs a database query. A video panel sees a face on a screen for 45 minutes. A recruiter who’s done 20 calls with a candidate over three weeks, checked their references personally, and watched how they talk about a job they didn’t get has a texture of information no automated system captures.
Devin’s version of the same point, from a different conversation: a client should work with “a firm who’s willing to show you how they make their money and not hide anything.” The inverse is true of fraud, too. An operation built on a hidden identity and hidden money cannot survive a recruiter who insists on knowing exactly who they’re vouching for.
What Access Should a New Remote Contractor Get on Day One?
Less than you think, and less than IT probably wants to set up for the tenth time this month.
Least privilege isn’t a buzzword here, it’s the actual control. A new remote contractor gets the one GitHub repo, the one AWS environment, and the one Slack channel their first assigned ticket touches. Nothing broader, nothing “just in case they need it later.” Expand access as trust builds over the first two to four weeks, not on day one, when you still don’t fully know who’s on the other end of that laptop.
We wrote the fuller version of this, system by system, in our contractor access and offboarding checklist. The short version: if a contractor’s access list on day one looks identical to a full-time employee’s access list after a year, something in onboarding skipped a step.
Does All This Vetting Slow Down a Contract Start?
Not meaningfully, if the recruiter runs identity verification alongside everything else, not after it.
Across KORE1’s own placements, nearly 2,000 contract searches tracked since 2019 and 79% of them in California, the median time from accepted offer to start date is 3 days (n=1,997). A live ID check, an independent reference call, and a shipping-address match add minutes to that process, not days. The median contract assignment itself runs 116 days (n=1,887), and 37.5% convert to a direct hire (n=552), which is exactly why getting the identity right at the start matters more than it would for a one-off gig.
Not slow. Just fast in the wrong direction. The companies that get burned skip the ID check because the candidate “seemed fine on the call,” and the req has already been open for ten weeks, and nobody wants to be the reason it stays open an eleventh.
Who Owns Which Control, Stage by Stage
| Hiring stage | Control | Owner |
|---|---|---|
| Sourcing | Independent reference calls, never candidate-supplied numbers | Recruiter |
| Interview | Live, moving ID verification on camera; watch for lip-sync lag and hairline artifacts | Recruiter and hiring manager |
| Offer | Device shipping address matched against verified ID and claimed location | HR and IT |
| Day one | Least-privilege access to only the first ticket’s systems; SOC alert on new-hire logins | IT and security |
What Hiring Managers Want to Know
How do I verify a remote contractor’s identity before giving them system access?
Three checks catch most fakes: a live, moving ID check on camera, a shipping address that matches that ID, and a reference call you place yourself.
None of those three require new software or a vendor contract. They require someone on your team actually doing them before the offer goes out, not after the laptop ships.
How can I tell if a candidate is using a face swap in a video interview?
Usually you can’t be certain on a first call, but a hairline that doesn’t move naturally, eyes that briefly misalign during fast motion, and lip movement that lags the audio are the tells security researchers look for.
Palo Alto Networks’ Unit 42 has documented all three in deepfake overlays used during real interviews, and says a convincing version takes under an hour to build with free tools.
Is a background check enough on its own?
Not on its own. A background check confirms a stolen identity is clean, because the identity itself, not the person using it, is what gets checked.
KnowBe4’s background check on their North Korean hire came back completely clean, because the Social Security number and name belonged to a real American whose identity had simply been stolen. Our own guide to employer background checks covers what a standard check actually catches, and what it never will.
What’s the fastest way to spot a laptop-farm red flag?
One mismatched shipping address is usually the whole tell.
If the company laptop is headed to an address that doesn’t match the verified ID, or to a state the candidate swears they’ve never lived in, that’s not a moving-day quirk. Stop onboarding and ask why before the device ships.
Should every remote contractor go through this level of vetting?
Kind of the wrong question. Every remote hire gets the same baseline, ID verification and reference checks either way, and what should scale past that baseline is system access, not job title.
A contract marketing writer and a contract systems administrator with production access aren’t the same risk. Not close. Match the control to the access. Not to the title on the offer letter.
Identity fraud in remote technical hiring isn’t a problem that gets solved by better software alone, whether you’re hiring out of Irvine or fully remote across the country. It gets solved by someone on your side who insists on knowing who they’re actually hiring, through contract staffing or any other arrangement. Our IT staff augmentation playbook covers the access and onboarding side of this in more depth once a contractor’s identity is confirmed and the role is live.
If you want identity-verified contractors on your next search, talk to a recruiter about how we vet candidates before you ever see a resume.
