The numbers come first. Endorsed, a San Francisco identity-verification startup, analyzed 175,000 U.S. job applications in 2026 and found that among remote IT roles, the share flagged with North Korean fraud patterns jumped from 11% in the third quarter of 2024 to 44% a year later. The company estimates the rate hit 47% in the most recent quarter.
The scheme is straightforward: men from the Democratic People's Republic of Korea pose as American IT workers so their wages can be funneled into Kim Jong Un's nuclear weapons program, according to the United Nations. Endorsed's data, drawn from more than 11 million job applications, shows the operatives favor claiming Texas as their home state — 26.5% of flagged applications — followed by California at 14.4% and Florida at 7.2%. Dallas, Austin and Houston are the most popular claimed hometowns.
The fraudulent applicants also gravitate toward familiar institutions. The University of North Texas and UT Austin top the list of purported alma maters, followed by the University of Central Missouri and UT Dallas. For past employers, the fake candidates most often claim Amazon, Google and Meta, with Capital One, CVS Health, Microsoft and Stripe also common choices. Sai, Michael, David and Kevin are the preferred first names, and more than half of the applications included a LinkedIn profile.
Endorsed CEO David Head said the camouflage works precisely because none of these details look suspicious in isolation. 'One or even several of these traits should never make an applicant seem suspicious on their own,' he said. 'The risk comes from a broader pattern of inconsistencies and behavior, not someone's name or background.'
The infiltration is not hypothetical. Thousands of North Korean workers have taken positions at Fortune 500 companies undetected, often with American accomplices. A New Jersey facilitator was sentenced to nine years in prison in April for running a ring that placed operatives inside more than 100 U.S. companies.
Yet capital is not rushing to fund the fix. Cybersecurity venture funding was flat at $8.5 billion in the first half of 2026 while deal count fell 23.8%, according to PitchBook's Q2 2026 report. The second quarter's $3.8 billion across 165 transactions was the weakest since late 2024. Identity and access management funding shrank from $0.8 billion in the first quarter to $0.3 billion in the second, a pullback PitchBook attributes partly to fears that AI-native startups will be eclipsed by frontier models. Still, the firm remains bullish on the category given that nonhuman identities now outnumber humans roughly 45 to 1 inside a typical enterprise.
The market has already voted on where the real vulnerability sits. Corporate HR departments and the federal enforcement apparatus have spent years chasing a threat that keeps outrunning them, while a private startup backed by venture capital — not a new regulatory mandate — is doing the work of mapping the fraud in real time.
That is the story underneath the story: a hostile regime is exploiting the seams of remote work and lax verification to bankroll a nuclear program, and it is private enterprise, not Washington's bureaucracy, that is building the tools to catch it. Sovereignty and national security depend on companies doing what regulators have been slow to demand — verifying who is actually on the other end of the Zoom call before the paycheck clears.
