AI screening startup detects North Korean infiltration in half of remote IT job applications
Identity verification firm Endorsed analyzed 175,000 job applications and found that 47% of remote IT roles showed patterns linked to North Korean operatives, up from 11% in late 2024. The fake applicants often claimed to be from Texas and listed Amazon, Google, or Meta as past employers. The company uses AI to flag these risks for human review.
Endorsed has screened over 11 million applications and counts Joe Montana's Liquid 2 Ventures among its backers. The firm's data shows flagged applicants disproportionately claim Texas roots, with Dallas, Austin, and Houston as preferred hometowns, while the University of North Texas and UT Austin top the list of purported alma maters. Amazon, Google, and Meta are the most commonly cited past employers.
The scheme's scale is substantial: a New Jersey facilitator received a nine-year prison sentence in April for placing operatives inside more than 100 U.S. companies. The United Nations has linked these operations to forced labor funneling earnings into North Korea's weapons programs. Meanwhile, cybersecurity venture funding remained flat at $8.5 billion in early 2026, with deal counts falling nearly 24%.
This trend could significantly reshape remote hiring practices, potentially forcing companies to implement stricter identity verification that may burden legitimate applicants with additional screening steps. Job seekers with common names or backgrounds matching flagged patterns could face heightened scrutiny, while smaller firms lacking robust vetting resources may remain vulnerable. The findings also suggest broader economic implications, as businesses weigh hiring efficiency against security risks in an increasingly distributed workforce.