In a concerning evolution of cyber infiltration tactics, North Korean IT workers have begun deploying sophisticated real-time deepfake technology during remote job interviews to secure positions within organizations worldwide.

This advanced technique allows threat actors to present convincing synthetic identities during video interviews, enabling them to bypass traditional identity verification processes and infiltrate companies for financial gain and potential espionage.

The approach represents a significant advancement over previous methods where DPRK actors primarily relied on static fake profiles and stolen credentials to secure remote positions.

The Democratic People’s Republic of Korea (DPRK) has consistently demonstrated interest in identity manipulation techniques, previously creating synthetic identities supported by compromised personal information.

This latest methodology employs real-time facial manipulation during video interviews, allowing a single operator to potentially interview for the same position multiple times using different synthetic personas.

Comparison of two deepfake interviewees (Source – Palo Alto Networks)

Additionally, it helps operatives avoid being identified and added to security bulletins and wanted notices issued by international law enforcement agencies.

Palo Alto Networks researchers at Unit 42 have identified this trend following analysis of indicators shared in The Pragmatic Engineer newsletter, which documented a case study involving a Polish AI company encountering two separate deepfake candidates.

The researchers noted that the same individual likely operated both personas, displaying increased confidence during the second technical interview after experiencing the interview format previously.

Real-time Deepfake

Further evidence emerged when Unit 42 analyzed a breach of Cutout.pro, an AI image manipulation service, revealing numerous email addresses likely tied to DPRK IT worker operations.

A wanted poster for DPRK IT workers (Source – Palo Alto Networks)

The investigation uncovered multiple examples of face-swapping experiments used to create convincing professional headshots for synthetic identities.

What makes this threat particularly concerning is the accessibility of the technology – researchers demonstrated that a single individual with no prior image manipulation experience could create a synthetic identity suitable for job interviews in just 70 minutes using widely available hardware and software.

The technical implementation of these deepfakes typically involves utilizing generative adversarial networks (GANs) to create realistic face images, combined with facial landmark tracking software that maps expressions from the operator to the synthetic face in real-time.

The resulting video feed is then routed through virtual camera software that presents the deepfake as a standard webcam input to video conferencing applications.

The real-time deepfake systems do exhibit technical limitations that create detection opportunities.

Most notably, these systems struggle with rapid head movements, occlusion handling, lighting adaptation, and audio-visual synchronization.

When an operator’s hand passes over their face, the deepfake system typically fails to properly reconstruct the partially obscured features, creating noticeable artifacts. Similarly, sudden lighting changes reveal inconsistencies in rendering, particularly around facial edges.

To combat this emerging threat, organizations should implement multi-layered verification procedures throughout the hiring process, including requiring candidates to perform specific movements that challenge deepfake software capabilities, such as profile turns, hand gestures near the face, or the “ear-to-shoulder” technique.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

The post North Korean IT Workers Using Real-time Deepfake to Infiltrate Organizations via Remote Job appeared first on Cyber Security News.