A Real-Time Deepfake Can Now Pass a Live Job Interview. North Korea Already Does It.

The face on the video call was built in 70 minutes

A researcher with no deepfake experience, a five-year-old computer, and a graphics card bought in 2020 set out to see how hard it would be to fake a human face in a live job interview. It took 70 minutes. Using free software and an AI-generated face from a site that invents people who do not exist, they built a synthetic identity convincing enough to sit across from a hiring manager on a video call and answer questions in real time.

That demonstration, published by Unit 42, the threat research arm of Palo Alto Networks, is not a thought experiment. It maps almost exactly onto a fraud scheme that has placed North Korean operatives on the payrolls of hundreds of Western companies. On June 8, 2026, the law firm Skadden pulled together the recent wave of U.S. enforcement actions against the scheme, and the picture it paints should change how your company treats a routine video interview.

What is actually happening

The operation is simple in outline and disciplined in practice. North Korea trains skilled IT workers, issues them fabricated identities, and has them apply for remote software, design, and support roles at companies in wealthier countries. Their wages, often drawn from several jobs held at once, flow back to the regime, where the United Nations estimates the program raises between 250 million and 600 million dollars a year to fund sanctioned weapons and ballistic missile work. Operatives are active in more than 40 countries.

The part worth understanding is how they clear the interview and the laptop. During the interview they run a real-time deepfake: a face-swap model takes the operative's live webcam feed and paints a different, AI-generated face over it, fed into Zoom or Teams through a virtual camera (software that impersonates a real webcam). This lets one person interview for the same role repeatedly as different people, and keeps their actual face off the FBI's wanted notices. Once hired, the company ships a laptop to a U.S. address. That address is a laptop farm, a facilitator's home where the machine sits plugged in and running so the operative can reach it remotely through tools like AnyDesk or TeamViewer over a VPN, making each login look domestic. To carry several jobs at once, they lean on AI coding assistants to turn out work that is just good enough to avoid a second look.

• The U.S. Department of Justice has charged more than 40 people. In April 2026, two U.S. nationals were sentenced to multi-year prison terms for running laptop farms that let operatives pose as staff at over 100 American companies using more than 80 stolen identities.
• CrowdStrike, which tracks the group as FAMOUS CHOLLIMA, has found these operatives posing as insiders at more than 100 mostly U.S. technology firms.
• The FBI warns the workers increasingly turn to extortion once inside, copying source code to personal accounts and harvesting credentials and session cookies for later attacks.

Why your hiring process is now a security control

The concrete damage is already on the record: stolen source code, triggered data breaches, and hundreds of millions of dollars a year delivered to a sanctioned weapons program. The harder question for your organization is where the exposure sits. Prosecutors treat the companies that hired these people as victims, but a victim still pays for the forensic investigation, the breach notifications, and the legal review, and may carry sanctions exposure depending on what the operative was able to touch. The shift to name in your next planning meeting is that the video interview, long run as an HR formality, has quietly become an identity check your security team has a stake in. Seeing a face on the call is no longer proof of who you hired. The trend runs one way: the 70 minutes it takes to build a passable fake will keep shrinking, and the tools that detect deepfakes lag behind the tools that make them.

What to do about it

1. Make interviewers test the face on camera. Ask the candidate to turn fully to profile or pass a hand in front of their face, because today's real-time deepfakes still smear or glitch when a hand crosses the face or the head turns sharply.
2. Verify identity through channels the candidate does not control. Confirm employment and education with the institutions directly rather than the references on the resume, and match a live ID check against the person on the call, since the whole scheme rests on documents and contacts the operative fabricated.
3. Ship laptops only to the address on a verified ID, and watch how they connect. Send equipment nowhere else, and flag remote-access tools, anonymizing VPNs, and logins from unexpected locations, because the laptop farm and the remote session are the steps that turn a bad hire into standing access.

Bottom line

This scheme works because it attacks the one place most security programs never watched: the hiring funnel. A generated face clears the interview, a stranger's spare room stands in for a U.S. address, and an AI coding assistant passes for competent work. None of it requires breaking your firewall, because you opened the door and issued the badge yourself. Bring one question to your next hiring review. If the next promising remote engineer your team interviews were a real-time deepfake fronting for a sanctioned regime, is there a single step in your process that would catch it before the laptop ships?