The candidate fraud case files, sourced and plain-english.

The candidate fraud case files.

Case files

Hiring fraud case studies.

Documented cases of the North Korean IT scam, deepfake candidates, proxy interviews, answer-feeding tools, job stacking and recruiter impersonation. what happened, how it was detected, what it cost, and what would have prevented it. every fact links to a primary source.

case file 09 · September 2026resume fraud

47% of US remote IT applications show fraud

A hiring verification company that has screened more than 11 million applications found that the share of U.S. Remote IT applications showing North Korean fraud patterns rose from 11 percent in late 2024 to 47 percent in late 2026.

47%Of remote IT applications, Q3 2026

11%The same measure, Q3 2024

175kFlagged applications analysed

Read the case

case file 08 · August 2026north korean it scam

Hiring fraud spreads to healthcare and sales

Huntress documented three 2026 cases outside technology: an Australian healthcare company with three fraudulent employees, a finance firm where hardware was wired into a workstation to stream video into Zoom, and a sales hire who had face-swapped himself into a real person's ID documents.

3Documented 2026 cases

13 DaysFrom onboarding to detection, one case

3Fraudulent hires at one healthcare firm

Read the case

case file 06 · July 2026north korean it scam

A North Korean IT worker inside a US agency

In July 2026 an FBI deputy assistant director told a government technology panel that the Bureau had identified, that week, a North Korean remote IT worker employed as a contractor at a U.S. Federal agency.

1Federal agency, confirmed

OngoingInvestigation

Read the case

case file 07 · April 2026synthetic identity

42 GitHub accounts, one fake-candidate operation

Group-IB traced a reusable-identity ecosystem running since at least 2021: the same GitHub account renamed from one invented engineer to another, AI-generated headshots, and stored logins for every freelance and payment platform that matters.

42GitHub accounts

79Email addresses

23Fake portfolio domains

Read the case

case file 12 · December 2025recruiter impersonation

Fake recruiters using a real company's name

Scammers impersonate real recruiters at real companies, run fake interviews, send fake offer letters, and ask the candidate for money. The recruiters whose names are stolen find out when victims contact them.

160+Impersonated recruiters catalogued publicly

24,688Employment fraud complaints to the FBI in 2025

$363mReported losses to job seekers in 2025

Read the case

case file 04 · October 2025proxy interview

Fake Mexican candidates who spoke no Spanish

Bitso's security team documented two applicants for a senior engineering role who used stolen resumes and AI-generated faces, said they were from Jalisco and Chihuahua, and could not speak Spanish. Their LinkedIn profiles vanished after the interviews.

2Applicants, one role

0Words of Spanish spoken

Same dayProfiles deleted after the call

Read the case

case file 01 · July 2025north korean it scam

Laptop farm in Arizona served 309 US companies

For three years, a woman in Litchfield Park, Arizona kept dozens of company laptops running in her home so North Korean IT workers could appear to be logging in from America. 309 U.S. Companies paid them.

309U.S. Companies affected

68Stolen American identities

$17mRevenue generated

Read the case

case file 11 · July 2025job stacking

One engineer secretly holding four startup jobs

A software engineer was hired by a string of venture-backed startups at the same time, without telling any of them. It only unravelled when one founder posted a warning and other founders recognised the name.

~$200kBase salary offered, per role

SeveralConcurrent employers

One postIs how it came apart

Read the case

case file 05 · June 2025north korean it scam

29 laptop farms raided across 16 states

In June 2025 the Justice Department searched 29 known or suspected laptop farms across 16 states, seized 29 financial accounts and 21 fraudulent websites, and charged the American facilitators making the whole thing possible.

29Laptop farms searched

16States

100+U.S. Companies affected

Read the case

case file 10 · 2025answer feeding

An interview cheating tool that raised $20m

A Columbia student built software that fed him answers during a technical interview, used it to get an Amazon internship, was suspended, and turned it into a venture-funded company whose slogan is cheat on everything.

$20m+Raised by one such company

InvisibleTo the interviewer, by design

GoogleConsidered ending virtual interviews

Read the case

case file 03 · March 2025deepfake

Two deepfake candidates caught on video

Hiring for one backend role out of about 500 applicants, security startup Vidoc got two AI-deepfaked candidates deep into its pipeline. One was exposed by a request that took three seconds: cover part of your face with your hand.

2Deepfaked candidates in one pipeline

~500Applicants for the role

3 SecTo break the filter

Read the case

case file 02 · July 2024north korean it scam

KnowBe4 hired a North Korean engineer

KnowBe4 trains other companies to spot social engineering. It interviewed a principal software engineer four times on video, ran a background check, checked references, hired him, and shipped him a Mac. Malware started loading 25 minutes after it arrived.

4Video interviews passed

25 MinFrom delivery to malware

0Data lost

Read the case