North Korean scammers target US remote IT jobs
Half of remote IT job applications now carry North Korean fraud patterns.
1Rise of North Korean scammers
Identity verification startup Endorsed found that 47% of remote IT job applications in the US now exhibit North Korean fraud patterns. This rate has quadrupled from 11% in Q3 2024. North Korean men are posing as IT workers to fund Kim Jong Un's nuclear weapons program, with UN reports indicating forced labor involvement. The sophisticated operation targets hundreds of US companies across various sizes.
2Most common fake details
Endorsed's analysis reveals North Korean scammers most frequently claim origins from Texas (26.5%), California (14.4%), and Florida (7.2%). Dallas, Austin and Houston top the city list. For education, University of North Texas and UT Austin are favorites, while Amazon, Google and Meta lead fake employment histories. Over 50% include LinkedIn profiles to enhance credibility, blending seamlessly with legitimate applicants.
3The art of being ordinary
Endorsed CEO David Head explains scammers deliberately choose common names and references: 'No single detail should raise suspicion alone. Risk emerges from broader inconsistency patterns.' Popular aliases include Sai, Michael, David and Kevin. Thousands have infiltrated Fortune 500 companies undetected, with American accomplices often facilitating the schemes through complex networks.
4American accomplices exposed
In April 2026, a New Jersey facilitator received a 9-year prison sentence for placing North Korean operatives in over 100 US companies. Domestic collaborators form crucial links in these operations. Endorsed's algorithm, which has scanned 11 million applications, goes beyond biographical details to analyze device, network and behavioral signals, though all decisions require human approval for final verification.
5Cybersecurity investment slowdown
PitchBook data shows cybersecurity funding remained flat at $8.5B in H1 2026 while deal count fell 23.8%. Q2's $3.8B across 165 deals marked the lowest activity since late 2024. Identity and access management (IAM) investments plummeted from $800M to $300M quarter-over-quarter. Investor interest appears shifting from AI-native security startups toward frontier models like Anthropic's Mythos platform.
6Endorsed's unique positioning
Endorsed operates at the intersection of HR tech and cybersecurity. Its model analyzes device, network and document signals beyond surface-level biographical data, with humans making final verification calls. CEO David Head notes, 'Nonhuman identities outnumber humans 45:1 in enterprises,' highlighting IAM's growth potential despite current funding declines in the cybersecurity sector.
7Ironic coincidence: The CTO's profile
Endorsed CTO Kevin Fu coincidentally matches key scammer patterns: raised in Dallas suburbs, UT Austin alumnus, and longtime Microsoft/LinkedIn employee. CEO Head joked about the irony: 'We've scanned him with Endorsed though, and I can verify he's legitimate.' This underscores how sophisticated scammers have become at mimicking authentic American tech worker profiles.
8New era in fraud prevention
Traditional verification methods fail against North Korean scammers. Startups like Endorsed combat this through behavioral analytics and multi-layered authentication. However, declining cybersecurity investments may hinder innovation. As remote work expands in IT, this battle grows increasingly critical. The solution lies in balancing technological sophistication with human oversight to maintain both security and hiring efficiency.