Cases › security breach › LR-2026-0674
North Korean IT workers use real-time deepfakes to beat hiring checks
Preliminary Why: 1 report: Tech Times · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties, a stated count of two or more affected parties. Fact: the cited laptop farms helped workers obtain employment at more than 100 US companies.
North Korean IT operatives used real-time AI deepfake video to impersonate real people during live job interviews, then routed company laptops to overseas workers through laptop farms in US homes. The video feeds looked like a normal call to hiring managers who were not probing for AI artifacts. Eleven governments issued a joint alert on July 31, 2026. In April 2026, two US residents were sentenced for laptop farms that placed workers at more than 100 companies and compromised the identities of at least 80 American citizens. A legal analysis found that firms which unknowingly hired these workers were characterised as victims but are not in the clear. A proposed US bill would coordinate allied action against the schemes.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelMarking machine-made output · Abuse monitoring and account enforcement · Content safety classifiers
ApplicationPeople told they are dealing with AI
Infrastructure / targetEvidence
No source states: a step-by-step account, when it happened, when it was found, the direct loss, any court case, the cause, what set it off, what was done.
Show the full account: 7 items from the primary sources
What happened, in order
- 2024 Scheme funnelled about $800 million to Pyongyang in 2024.
- 2026-03 OFAC sanctioned six individuals and two entities connected to the scheme.
- 2026-04 Two New Jersey residents sentenced for operating laptop farms.
- 2026-05 Two more laptop farm operators sentenced.
- 2026-06 Skadden analysis finds firms that unknowingly hired workers are not in the clear.
- 2026-07-27 North Korean FAKER Act referred to the House Foreign Affairs Committee.
- 2026-07-31 Eleven governments issue a joint advisory on the deepfake hiring threat.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
Disclosure date taken as the advisory date 2026-07-31. The remediation is advice from the sources, not a change a party reported making.
LR-2026-0674 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON