North Korean Fake Employees: The AI Threat Hitting Western Firms

Jan de Vries · 2026-10-26

Steve Durbin, the security chief at the Information Security Forum, has a warning that should make every business leader sit up: North Korean agents are infiltrating Western companies by posing as employees. They're not breaking in through the back door. They're applying for jobs, getting hired, and then quietly stealing sensitive data. This isn't a plot from a spy novel. It's happening right now, and it's a growing problem for companies across the United States and Europe. Durbin points out that these operatives use fake identities and AI-powered deception to slip past background checks and interviews. Once inside, they have access to systems that hold everything from customer data to trade secrets. ### How They Get In The playbook is simple but effective. North Korean agents create convincing online profiles, complete with fabricated work histories and even AI-generated video interviews. They apply for remote positions, often in tech or finance, where they can operate from anywhere in the world. Because many companies are desperate for talent, they may overlook red flags. - **Fake identities:** Operatives use stolen or synthetic identities to create LinkedIn profiles and resumes. - **AI deception:** They use AI tools to generate realistic responses during interviews and even to mimic voices on calls. - **Remote work loophole:** The shift to remote work has made it easier for bad actors to hide their true location and identity. "The level of sophistication is increasing," Durbin says. "They're using AI to create deepfakes and to automate interactions. It's a challenge for even the most vigilant HR teams." ### Why It Matters for Startups For early-stage startups, the risk is especially high. They often lack the resources for thorough background checks and may be eager to fill roles quickly. A single infiltrator could compromise intellectual property or customer data, leading to financial loss and reputational damage. But it's not just about theft. These agents can also plant malware or create backdoors for future attacks. And because they're embedded as employees, they can go unnoticed for months. ### What Can You Do? Durbin recommends a few practical steps. First, verify identities more rigorously, especially for remote hires. Use video interviews and ask for government-issued IDs. Second, monitor employee behavior for unusual access patterns. Third, train your team to recognize signs of deception. "It's about creating a culture of security," Durbin says. "Everyone needs to be aware that this threat exists." As the line between physical and digital security blurs, companies must adapt. The North Korean fake employee scheme is a reminder that in the modern workplace, trust must be earned—and verified.