Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds

San Francisco-based identity verification startup Endorsed, co-founded by David Head and Kevin Fu, has discovered a surge in North Korean fraud in remote IT job applications. AI-powered screening tools used by Endorsed now detect these patterns, which have increased from 11% of applications in the third quarter of 2024 to 44% by the following year.

The fraud pattern is most prevalent in U.S.-based remote IT roles, where North Koreans are posing as IT workers to funnel earnings into Kim Jong Un's nuclear weapons program. Head explains that these scammers choose familiar names, cities, employers, and schools to blend in with real job applicants, but a broader pattern of inconsistencies and behavior is what truly exposes them.

Popular claimed origins for the North Korean imposters include Texas (26.5%), California (14.4%), and Florida (7.2%), with Dallas, Austin, and Houston being the most favored cities. Universities like the University of North Texas and UT Austin, as well as companies like Amazon, Google, and Meta, are commonly reported by the fraudsters.

Despite this alarming trend, venture capitalists are becoming more selective, with cybersecurity funding remaining flat at $8.5 billion in the first half of 2026, and a 23.8% decline in the number of deals.