{"id":16168,"date":"2026-05-04T09:06:49","date_gmt":"2026-05-04T09:06:49","guid":{"rendered":"https:\/\/newestek.com\/?p=16168"},"modified":"2026-05-04T09:06:49","modified_gmt":"2026-05-04T09:06:49","slug":"the-fake-it-worker-problem-cisos-cant-ignore","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16168","title":{"rendered":"The fake IT worker problem CISOs can\u2019t ignore"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Hiring fake IT workers has been a growing problem in recent years \u2014 but it\u2019s often a problem very few want to admit to. From Fortune 500 companies down to smaller organizations, remote hiring practices have been exploited to grant trusted access to individuals who are not who they claim to be creating an insider threat risk.<\/p>\n

Estimates suggest there are thousands of fake IT workers operating across the US who are in a position to steal information, IP and data, outsource work offshore, carry out sabotage, or funnel money to foreign governments.<\/p>\n

Amazon has identified and blocked more than 1,800 attempts by North Korea to secure IT roles \u2014 and the numbers are rising, according to its chief security officer, Steve Schmidt.<\/p>\n

In some cases, individuals impersonate US employees for personal gain; in others, state-based operatives such as those from North Korean pose as IT workers for state financial gain and other nefarious purposes.<\/p>\n

AI is now enabling deepfakes, more convincing video interviews, and rapid identity cycling.<\/p>\n

Adversary tactics are also shifting, from fabricating profiles to purchasing legitimate American identities, Schmidt has warned.<\/p>\n

\u201cThis is not a \u2018recruiting scam\u2019 in the traditional sense. It\u2019s an insider-risk problem, where the adversary\u2019s first move is to get hired,\u201d says Tom Hegel<\/a>, distinguished threat researcher at SentinelOne.<\/p>\n

CIOs, CISOs, and other IT leaders need to be continually on guard against fake and fraudulent IT workers, but organizations can fall victim without realizing it.<\/p>\n

How fake hires get through<\/h2>\n

There\u2019s no single point of failure in the recruitment process. Fake and fraudulent IT workers conceal their identity, falsify their skills and experience, and move through interview and screening processes undetected.<\/p>\n

SentinelOne has tracked<\/a> roughly 360 fake personas and more than 1,000 job applications linked to North Korean IT worker operations, including attempts to apply for roles within the company itself.<\/p>\n

According to Hegel, adversaries are increasingly deploying social engineering tactics and identity obfuscation at scale, and the hiring process is a prime entry point.<\/p>\n

Synthetic or stolen identities are used to create resumes and online profiles; interviews are passed with the help of scripts, stand-ins, or AI-assisted responses; and background checks confirm only what\u2019s presented to them.<\/p>\n

\u201cFake job seekers now leverage AI tools to mimic legitimate candidates, creating synthetic identities that pass initial background checks, falsifying employment histories and even responding convincingly in interviews using real-time AI assistance,\u201d Hegel says.<\/p>\n

Flashpoint investigations<\/a> have found malware-infected hosts containing HR and job-board logins, browser histories showing Google-translated coaching notes, remote-access \u201claptop farms\u201d used to control corporate devices from overseas, and shell companies to prove reference checks for fabricated resumes.<\/p>\n

Once they\u2019re hired, credentials are issued, equipment is shipped, and access is granted \u2014 and they become a trusted insider. \u201cThe long-term risk isn\u2019t just hiring a fake employee \u2014 it\u2019s unknowingly opening your systems and sensitive data to malicious access,\u201d he says.<\/p>\n

What to do if you suspect a fake IT worker<\/h2>\n

When a CIO suspects a fake IT worker, next steps are important as the issue shifts from recruitment to insider risk management.<\/p>\n

During his time at MongoDB, George Gerchow<\/a>, IANS faculty advisor and Bedrock Data CSO, oversaw the investigation after the company detected it had unknowingly hired a North Korean IT worker.<\/p>\n

It was first discovered after alerts that an individual was attempting to uninstall endpoint protections, including CrowdStrike Overwatch. \u201cOverwatch then detected the laptop communicating with a North Korean IP address,\u201d says Gerchow.<\/p>\n

\u201cThat combination of tool tampering plus DPRK-linked traffic immediately signaled that this was not a typical new hire,\u201d he tells CIO.<\/p>\n

Mongo realized the fake worker used a stolen identity, paired with AI-generated resume content and scripted interview responses, to evade background checks that verify only the information provided and do not detect fraud.<\/p>\n

It highlights a gap in many background checks. \u201cThey don\u2019t detect fabricated work histories, synthetic identities, or recycled developer profiles, which is how this individual passed screening and interviews without raising formal flags,\u201d he says.<\/p>\n

The subsequent investigation found attempts to disable security tooling, establish persistence on the device, and probe for elevated access.<\/p>\n

\u201cHad they remained undetected, their access would have eventually expanded into our FedRAMP environment, which makes these fraud techniques especially high-risk,\u201d Gerchow adds.<\/p>\n

After the discovery, several yellow flags became obvious such as poor video quality and unclear visuals during interviews, a noticeably inconsistent accent between calls, and scattered interview feedback with no centralized review.<\/p>\n

Another tell was a last-minute change to the laptop shipping address. \u201cThat\u2019s a common shadow-worker tactic,\u201d notes Gerchow.<\/p>\n

With hindsight, Gerchow joined the dots and it became clear how the person had made it through to employment because any irregularities were treated in isolation.<\/p>\n

\u201cNone of these individually would prevent a hire. However, because no one was responsible for aggregating subtle anomalies, the pattern wasn\u2019t recognized until the endpoint alert fired,\u201d he says.<\/p>\n

When they were discovered, the team quickly isolated the device, revoked all credentials, conducted a full forensic investigation, and notified federal authorities. \u201cWe verified there was no data exfiltration or lateral movement,\u201d he says.<\/p>\n

The mitigation steps introduced included strengthening identity fraud screening in the hiring process, assigning a Yellow Flag owner to connect early signals, and enforcing zero access until trust is earned for new hires,<\/p>\n

Gerchow also believes that behavioral telemetry post-hire is necessary, because behavior, not credentials, reveals impostors.<\/p>\n

Mongo recommends organizations designate a reviewer in Security or HR to identify inconsistencies in the hiring process, such as poor video quality. \u201cAlso watch for AI-generated LinkedIn profiles, mismatched resumes and questionable changes in laptop shipping addresses,\u201d he says.<\/p>\n

\u201cUse panel interviews and project-based evaluations to identify candidates who recycle stolen or fake developer identities, and start new hires without access to sensitive data or production environments,\u201d he advises.<\/p>\n

Then employ alerts if security agents (such IAM, EDR, VPN) are disabled before a new hire logs in, and test detection, escalation, and device recovery by simulating the hiring of a fake developer.<\/p>\n

\u201cAnd look for off-hours access, broad internal search activity and large-scale cloning of documents or code repositories,\u201d he adds.<\/p>\n

What IT leaders see on the inside<\/h2>\n

The problem of employment fraud is only expected to worsen, with Gartner predicting<\/a> that one in four candidate profiles worldwide will be fake by 2028.<\/p>\n

\u201cThe rise of fake and fraudulent job applicants has become an epidemic across organizations,\u201d says David Weisong<\/a>, CIO of Energy Solutions.<\/p>\n

Weisong says attackers consistently target high-access technical roles such as DevOps, systems administrators, data engineers, and database administrators, where successful hires can gain deep visibility and control over core systems.<\/p>\n

\u201cThese are the roles with the keys to the castle,\u201d Weisong says. \u201cIf you\u2019re trying to gain access, they\u2019re far more valuable than a standard developer position.\u201d<\/p>\n

Operating in a regulated energy market, Energy Solutions is contractually required to employ a US-based workforce and keep data within US jurisdiction.<\/p>\n

Weisong has first-hand experience with detecting fake IT workers and wants to share his advice with other IT leaders. One of the earliest warning signs was a sudden, abnormal surge in applications \u2014 hundreds arriving within hours, far out of proportion to the company\u2019s brand profile, pointing to automated or coordinated activity.<\/p>\n

During the interview stage, identity switching was observed. \u201cWe saw cases where one person passed the phone screen, a different person showed up on Zoom, and sometimes a third appeared later \u2014 all under the same name and resume,\u201d Weisong says.<\/p>\n

Part of the problem is that standard hiring practices validate information and skills in isolation. \u201cTraditional background checks only verify the information provided and do not detect fraud,\u201d Weisong also notes.<\/p>\n

The uncomfortable reality for some CIOs is that the work may be completed to a high standard and detection comes from signals, not performance.<\/p>\n

However, fake IT workers create business and compliance risk as much as security risk, exposing organizations to contractual breaches, regulatory consequences, and loss of client trust \u2014 particularly in regulated industries.<\/p>\n

Weisong says fake IT workers create business and compliance risk as much as security risk, exposing organizations in regulated industries to contractual breaches, regulatory scrutiny, and loss of client trust.<\/p>\n

Combating the problem of fake IT workers<\/h2>\n

Amazon is using AI-based tools<\/a> with human oversight to identify unusual contact information, as well as fake academic institutions and companies in resumes, according to Schmidt. Security teams will flag LinkedIn profiles that look suspicious, require more in-person interviews and in-office attendance, monitor computer usage and quality of work, and authenticate with a physical token.<\/p>\n

He has also said that IT and HR need to collaborate on hiring to combat the problem.<\/p>\n

\u201cIt\u2019s actually a lot cheaper for the HR organization if we discover the problem up front,\u201d Amazon\u2019s Schmidt told Fortune<\/a>.<\/p>\n

The shift required, says SentinelOne\u2019s Hegel, is treating hiring decisions as an access control problem rather than a recruitment task. \u201cStop treating identity as a one-time HR checkbox and start treating remote hiring like you would grant privileged access,\u201d he says.<\/p>\n

In the wake of his experience, Weisong instituted a raft of changes to its applicant tracking system and across the organization\u2019s internal systems and processes.<\/p>\n

When advertising for positions, they make it clear that candidates applying for technical positions understand the expectations and consequences outlined in all written communication. \u201cAdditionally, removing the term \u2018fully remote\u2019 from our hiring practices has significantly reduced opportunities for fraud and for applicants applying from outside the US,\u201d he says.<\/p>\n

\u201cWhile a \u2018zero-trust\u2019 approach would be ideal for all hiring, we cannot allow it to impede the process or discourage legitimate candidates from applying. Instead, we need sufficient countermeasures to prevent automated and fraudulent applicants from reaching the pipeline in the first place,\u201d he adds.<\/p>\n

To control the large volume of applications, many of which are bots, Energy Solutions job listings now have strict CAPTCHA settings, referral bonuses help draw on employee networks, and there\u2019s a 90-day satisfactory performance review for new hires.<\/p>\n

During the screening process, interviews are conducted via video not phone, and applicants must share their screen for live challenges. A post-video interview report allows them to verify the exact location of applicants after screening and interview meetings. If a candidate is outside the US, it\u2019s treated as a Yellow\/Red flag.<\/p>\n

Applicants must select which office they want to work from and they must acknowledge they understand use of AI during interviews will result in disqualification.<\/p>\n

To verify references and employment history, they require two references, with one a former supervisor or manager. Employment history is checked, including previous employers, and full home address must be provided.<\/p>\n

To guard access, a question has been added to the job kick-off form that indicates whether a new role will have elevated access to confidential or sensitive information.<\/p>\n

The first day on the job requires new hires to come into an office to pick up equipment and undertake training and onboarding. All roles must be onsite, with the option to go hybrid after satisfactory performance.<\/p>\n

Combating the problem, says Weisong, requires reviewing hiring processes, partnering closely with HR, and monitoring the effectiveness of each countermeasure. For CIOs, the lesson is not that hiring is broken, but that trust must be earned progressively.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Hiring fake IT workers has been a growing problem in recent years \u2014 but it\u2019s often a problem very few want to admit to. From Fortune 500 companies down to smaller organizations, remote hiring practices have been exploited to grant trusted access to individuals who are not who they claim to be creating an insider threat risk. Estimates suggest there are thousands of fake IT… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16168","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16168"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16168\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}