David Head, chief executive of Endorsed, an identity-verification startup, warned that half of remote IT job applications now carry patterns linked to fraud operations run from North Korea. The company, which uses artificial intelligence to screen candidates, examined a sample of 175,000 applications submitted in 2026 to U.S. firms of varying size.
Scale of the problem
Endorsed found that applications flagged for mid-to high-risk North Korean patterns rose from 11% of the total in the third quarter of 2024 to 44% a year later, with the most recent quarter reaching a staggering 47%.
How fraudsters disguise themselves
The analysis shows that imposters often claim to be from Texas (26.5% of flagged cases), with California and Florida also common. Cities such as Dallas, Austin and Houston are repeatedly cited as hometowns. Educational backgrounds are fabricated to include the University of North Texas, the University of Texas at Austin, the University of Central Missouri and UT Dallas. Fake work histories frequently list Amazon, Google, Meta, Capital One, CVS Health, Microsoft and Stripe. First names like Sai, Michael, David and Kevin are popular, and more than half of the bogus profiles feature a LinkedIn link.
"One or even several of these traits should never make an applicant seem suspicious on their own," Head said. "The risk comes from a broader pattern of inconsistencies and behaviour, not someone's name or background."
The United Nations has reported that men forced to pose as IT workers funnel earnings to the regime's nuclear programme, underscoring the geopolitical dimension of the scheme.
Implications for hiring and security
Thousands of North Korean operatives have reportedly entered Fortune 500 firms undetected, sometimes with the aid of American facilitators. A recent case saw a New Jersey intermediary sentenced to nine years for placing operatives in over 100 companies.
Venture capital funding for cybersecurity has stalled, with PitchBook noting flat investment of $8.5 billion in the first half of 2026 and a 23.8% drop in deal count. Funding for identity and access management fell from $0.8 billion in Q1 to $0.3 billion in Q2, as investors worry about AI-native security startups losing appeal to newer models.
Future steps
Endorsed argues that simple checklists are insufficient. Its platform examines device and network data, document authenticity and behavioural signals, with a human reviewer making the final decision. When co-founder and CTO Kevin Fu matched several of the fraud patterns, Head joked that the company had to run its own verification on him to prove his legitimacy.
As remote work remains common, recruiters across Europe and beyond will need more sophisticated tools to differentiate genuine talent from state-backed deception.