I'm a security expert, and I almost fell for a North Korea-style deepfake job applicant …Twice
- Reference: 1739282472
- News link: https://www.theregister.co.uk/2025/02/11/it_worker_scam/
- Source link:
Moczadło is a security engineer who co-founded Vidoc Security Lab, a San Francisco-based vulnerability management company, in 2021.
"If they almost fooled me, a cybersecurity expert, they definitely fooled some people," Moczadło told The Register .
[1]
The startup is hiring employees to build out a product that, according to Moczadło, uses machine learning to find and fix vulnerable code written by Microsoft Copilot, ChatGPT, and human developers.
[2]
[3]
So it was a strange, Upside-Down world experience when in December, a job applicant made it through the first few rounds of interviews before moving on to a video call with Moczadło during which the co-founder says it became very obvious that the interviewee was using software to change his appearance in real-time.
"We spent and lost more than five hours on him," Moczadło said. "And the surprising thing was, he was actually good. I kind of wanted to hire him because his responses were good; he was able to answer all of our questions."
[4]
There were some red flags. Vidoc Security Lab was looking to hire developers in Poland, and as such had posted the ad on a Polish website. The applicant claimed to live in that country, and had a Polish name — but also had a strong Asian accent on phone calls with Moczadło and his co-founder, we're told.
"But I gave him the benefit of the doubt," Moczadło said.
As soon as he turned on his camera, I instantly knew
Until the video interview, that is. "We noticed it after the third or fourth step of our interview process," Moczadło recalled. "His camera was glitchy, you could see a person, but the person wasn't moving like a person. We spoke internally about him, and we thought, OK, this person is not real."
The applicant was rejected. Two months later, it happened again.
This second fake IT job candidate reached out to Moczadło and his colleagues via LinkedIn. According to the employment hopeful's phony profile, which has since been removed, and his résumé, which Moczadło shared with The Register , a person we'll just refer to as Bratislav claimed to be a software engineer from Serbia looking for a remote job.
[5]
Bratislav had about 500 connections on the Microsoft-owned social network, nine years of experience, and a computer science degree from the University of Kragujevac, all of which seemed legit to the Vidoc Security Lab team.
"His experience was decent, his surname was Slavic, his CV said he lived in Serbia and had a university degree from Serbia, but also he had a really strong Asian accent," Moczadło said.
'All of his answers were from ChatGPT'
During Bratislav's first round of interviews, he told Vidoc Security Lab that his camera wasn't working. Then on February 4, after rescheduling once with Moczadło, he agreed to an on-camera interview. "When he joined the meeting, as soon as he turned on his camera, I instantly knew," Moczadło said.
Plus, the job seeker's answers to interview questions seemed to be straight out of OpenAI's ChatGPT, the co-founder added. The interviewee's answers always had a lag time to them, and while they were "spot on," they weren't conversational but rather spoken in bullet points.
"ChatGPT has this style of answering in bullet points all the time, and he was answering in bullet points as well, like he was reading everything from ChatGPT," Moczadło said.
"And it was super hilarious for me," because for a second time he was interviewing an AI-generated face, Moczadło remembers. "So I thought, OK, this time I will record it, because so many people didn't believe me before that we got candidates like this."
Moczadło later [6]posted the video on LinkedIn with the job seeker's voice muted, and wrote: "WTF, developer used AI to alter his appearance during a technical interview with me. Yes, this is a real recording, it happened today."
To be clear: While The Register has not had a chance to perform deep forensic analysis of the video, it does appear the person's head doesn't quite match up with his neck and the face image glitches more than the neck and torso.
Moczadło also repeatedly asks the interviewee to wave his hand in front of his face — this is supposed to detect an AI-generated face because it disrupts the model and will make the image appear glitchy as the software lags while trying to integrate a real hand covering a deepfake face.
The interviewee refuses to do this, and Moczadło ends the call.
IT worker scam nets Norks $88m
Moczadło suspects that both of the fake job candidates were part of a larger bogus IT worker scam, along the lines of those [7]favored by North Korean techies that have netted Pyongyang least [8]$88 million over six years, according to the US Justice Department. What usually happens is that someone in or working for North Korea pretends to be a legit Western technology worker to get a remote job.
Once the fake IT workers obtain these positions in the US and elsewhere, they not only funnel their wages into Kim Jong Un's coffers, some also use their access to steal sensitive info to exploit and even [9]blackmail their employers , threatening to expose corporate assets if an extortion demand isn't paid.
The Feds have repeatedly claimed these [10]ill-gotten gains contribute to the DPRK's illegal weapons programs.
[11]Biz hired, and fired, a fake North Korean IT worker – then the ransom demands began
[12]North Korea's fake IT worker scam hauled in at least $88M over six years
[13]Security biz KnowBe4 hired fake North Korean techie, who got straight to work ... on evil
[14]Lights, camera, AI! Real-time deepfakes coming to DEF CON
Plus, US law enforcement and cybersecurity agencies have been warning companies for years that [15]deepfakes pose a growing threat to corporate IP and bank accounts, as well as companies' brand reputation.
I won't be able to decide if the person I'm talking with is a real person or not
"Multiple" infosec researchers have reached out to Moczadło, we're told; he said he has shared videos, screenshots, and other details with them to help attribute the activity to a particular criminal group or nation state.
"I feel kind of scared about the future," he said. "Right now the software that the person used wasn't that great. I was able to spot all of the artifacts and all of the glitches.
"But I'm scared that in a year, as AI advances, I won't be able to decide if the person I'm talking with is a real person or not." ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z6uCNkx1tDYrMVKhYc7OdgAAAQg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z6uCNkx1tDYrMVKhYc7OdgAAAQg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z6uCNkx1tDYrMVKhYc7OdgAAAQg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z6uCNkx1tDYrMVKhYc7OdgAAAQg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z6uCNkx1tDYrMVKhYc7OdgAAAQg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.linkedin.com/feed/update/urn:li:activity:7292604406464671744/
[7] https://www.theregister.com/2025/01/24/north_korean_devs_and_their/
[8] https://www.theregister.com/2024/12/13/doj_dpkr_fake_tech_worker_indictment/
[9] https://www.theregister.com/2024/10/18/ransom_fake_it_worker_scam/
[10] https://www.theregister.com/2024/10/08/us_lazarus_group_crypto_seizure/
[11] https://www.theregister.com/2024/10/18/ransom_fake_it_worker_scam/
[12] https://www.theregister.com/2024/12/13/doj_dpkr_fake_tech_worker_indictment/
[13] https://www.theregister.com/2024/07/24/knowbe4_north_korean/
[14] https://www.theregister.com/2024/08/04/realtime_deepfakes_defcon/
[15] https://www.theregister.com/2023/09/13/us_agencies_deepfake_threat/
[16] https://whitepapers.theregister.com/
Re: Old scams in new jackets
The first time I met our HR Manager (after I had been working for nearly a week), she told me that I was the only person she had ever employed that she had never spoken to, let alone seen.
It can happen when you are well known by the technical team in a fairly niche area of work.
A job's a job
Ignoring the political reality of everyday life -- a purely artificial construct at the best of times -- what you have is ultimately someone wanting to exchange labor for cash. We're told in this day and age that it doesn't matter if the person is physically present or working remotely, so long as they can do the job and they're cheap enough that's all that's important.
Ultimately the problem is the globalization of the labor pool. All this Cold War nonsense about spying, malware injection and general skulduggery is just nonsense except that people who are trying to squeeze every last cent out of a workforce are unlikely to want to invest the time and money in decent QA -- they want their code or services as cheaply as possible so opening their products to a whole hose of unwanted issues.
You can't fault people for trying it on even if the technology's not quite up to it yet. Supply meets demand -- we want an 'ideal' candidate so the market is responding by providing them.
Re: A job's a job
You can't fault people for trying it on even if the technology's not quite up to it yet.
Job-seeker: Hello,
Job-seeker: My name is Serge and will be defrauding you today. Please, take a look at my impressive statistics as produced by the best of machines.
Job-seeker: My video link is not always as good with our local bandwidth limitations. But we shall manage to impress you anyway.
Interviewer: How much would you like to defraud us for?
Job-seeker: Well, I've been thinking, as a good start, about €180k per year and all of your software.
Interviewer: That seems like a nice start. Can you tell me how you are going to do it all?
Job-seeker: Sure thing! You are --bzzzz-- going to --bzzzz-- sleep and --bzzzz-- sign al the documents --bzzzz--
Job-seeker: You are --bzzzz-- now obeying my commands --bzzzz--
Interviewer: Absolutely!
Interviewer: I welcome you to our team! All our moneys are belong to you!
Job-seeker: Thank you.
Re: A job's a job
Why all the down ticks?
It's what you get when the Finance Team control everything.
M'M'M'Max Headroom here.
https://youtu.be/cYdpOjletnc
The real problem
Is employers trying to hire on the cheap by using cheaper overseas developers. In this case, it's not like there's a lack of talent in the San Fransisco Bay Area. If you hire local you can interview people in person. If you are setting up an office overseas, again there are ways to do it where you actually meet people, or you work through representatives you have met in person. It's only a matter of time before some company gets the crap sued out of them by their customers because the house of cards the company created is considered negligence.
Re: The real problem
Not just meeting in person for the interview(s) I think: you also need to know that the person you hired is the person who's turning up at the office and/or working offsite.
Re: The real problem
Well, if employers are hiring so remotely then surely they're saying they don't really care. Do the job adequately and cheaply and I'll ask no questions. To be fair, that's the same approach when big companies offshore their IT or support functions.
Re: The real problem
>t's not like there's a lack of talent in the San Fransisco Bay Area.
Your mission is to hire the best possible XYZ developer possible, but you are only allowed to chose from people who currently live in SF and aren't current;y working for one of your competitors.
And you have to pay 5x as much because they have to afford to live in SF and you have to pay 5x as much for office space to be in SF.
It would be like limiting your choice of leaders to people who went to Eton and Oxford.
Re: I won't be able to decide if the person I'm talking with is a real person or not
Unless of course, you actually met them for real.
Jobs given by AI
If you haven't figured out yet, sites like linkin and indeed are data collection sites now. You get uploaded to the data warehouses where you are either sold off to third party companies doing nefarious things, or hacked. Very often hacked in fact. They like to get your email and phone numbers off these sites, and then target you if you look like you make money, or are important.
To get an interview, or to get looked at, you first have to get through the parameters set by the AI.
Interesting
"Moczadło also repeatedly asks the interviewee to wave his hand in front of his face — this is supposed to detect an AI-generated face because it disrupts the model and will make the image appear glitchy as the software lags while trying to integrate a real hand covering a deepfake face."
Hmm, nice trick, which will probably always have this lag ...
""But I'm scared that in a year, as AI advances, I won't be able to decide if the person I'm talking with is a real person or not." "
I'm not that worried TBH. There will always be differences between an educated person and a repeating IA no matter the size of the corpus used to train it.
We will adapt.Remember how Deckard could identify replicants in Blade Runner 2049 ? We'll do the same :)
Re: Interesting
you're in the desert....
Re: Interesting
But, how come I'd be there?
Mirror, Mirror ...
How can a real candidate know whether the interviewer is a deep AI fake? If its getting into difficulty it just has to say it's from HR. Who can tell the difference between a real HR person and a ZX-80 Eliza program with a nice backdrop?
Ooops, HR downvotes incoming...
Re: Mirror, Mirror ...
"Ooops, HR downvotes incoming..."
Unlikely, HR people can't find the on switch.
Old scams in new jackets
Online job-interview? How about "Please meet us at one of our local offices." .
I can't imagine to have any person employed when not seen and talked to by a real person. There is nothing more important than face-to-face and look-in-the-eye communication. There may be (trusted) people added via a video link, but the job-seeker should at least be seen by one trusted peer who is physically present with the job-seeker.