In March 2026, an “impersonator applicant” utilizing generative AI emerged during an online job interview at a Japanese IT firm, sending shockwaves through corporate recruitment practices. Behind this incident lies the rapid sophistication of deepfake technology and an intensification of organized infiltration operations by North Korean IT workers seeking foreign currency and corporate access.

AI Impersonation Case at a Domestic IT Firm Uncovered in March 2026

In March 2026, a candidate appearing to use generative AI to impersonate another individual emerged during an online interview for mid-career hiring at a Tokyo-based IT company, drawing widespread industry attention. The candidate applied through a talent recruitment platform with an English resume listing a career history at major Japanese IT companies and high Japanese language proficiency. However, the incident was uncovered when the interviewer noticed anomalies in response latency and linguistic phrasing. Investigations revealed that the candidate had unauthorizedly misused the facial photos, video, and professional background of Takefumi Yoshii, CEO of Reunion Software, an actual domestic IT startup. Video analysis conducted by three specialized institutions—including Nablas, a Tokyo University-launched startup, and US-based Okta—identified unnatural boundaries around the forehead and hairline, eye alignment shifts in specific frames, and audio-visual desynchronization (lip-sync lag), leading to a determination that the video was “extremely likely to be a deepfake.” During the interview, unnatural Japanese expressions such as referring to oneself as “go-jishin” (a honorific form meaning “yourself”), mispronouncing the target company’s name, and response delays caused by AI processing led human intuition to flag the fraud.

Evolution of Deepfake Technology Bypassing Human Visual Inspections

Previously, visual countermeasures in online interviews—such as asking candidates to turn their face sideways or wave a hand in front of their face to disrupt AI image synthesis—were considered effective. However, experts including Professor Isao Echizen of the National Institute of Informatics warn that rapid advances in generative AI have rendered such basic visual checks virtually ineffective. Real-time fake generation technology has evolved dramatically, while video compression algorithms in conferencing software tend to obscure fine digital artifacts. According to a study by Gartner, 39% of job seekers used some form of AI in the application process in 2024, and by 2025, 6% admitted to participating in interview fraud such as impersonating others. Gartner predicts that by 2028, 25% (one in four) of applicant profiles worldwide will be fake or fabricated, transforming interview anti-impersonation from an individual corporate challenge into a systemic security threat.

The following graphic illustrates the key detection points of AI impersonation in online interviews.

North Korean IT Workers Behind the Scenes and Their Organized Tactics

Organized Infiltration Operations Spanning Over 5,000 Companies and 6,500 Cases Worldwide

The incident in Japan is not merely an isolated case of individual resume fraud. According to research data from Okta, cases where suspected North Korean IT workers used AI and stolen personally identifiable information (PII) to bypass online interviews by posing as others have exceeded 5,000 companies globally, with more than 6,500 cumulative instances confirmed. These groups exploit profiles scraped from business networking platforms like LinkedIn and leaked government-issued IDs from the dark web to construct synthetic or real-person IT engineer personas. In late 2024, a investigation by Trend Micro discovered test deepfake videos and multiple falsified resumes on command-and-control servers operated by North Korea-linked cybercrime groups. The most frequently targeted job title is “Full-Stack Engineer,” chosen because a single individual can manage entire systems and full-remote work arrangements are easily justified.

The True Objective: Securing Legitimate Internal Corporate Access

There are two primary objectives behind North Korean IT workers infiltrating companies in Japan, the US, and Europe using fake identities. The first objective is earning foreign currency—remitting salaries and compensation earned from employment back to North Korea to fund state initiatives, including nuclear and missile programs. The second objective is obtaining legitimate internal access permissions to corporate systems. Unlike conventional external cyberattacks, once hired as an employee, the individual is granted official credentials, corporate PCs, and access rights to cloud storage and source code repositories. This exposes companies to severe risks, including the theft of confidential information, customer data, and intellectual property, as well as the insertion of malware. The Japanese government views this situation with high gravity; on July 31, 2026, the National Police Agency, the National Cyber Director’s Office, the Ministry of Foreign Affairs, the Ministry of Finance, and the Ministry of Economy, Trade and Industry issued a joint advisory with US and South Korean government agencies on North Korean IT workers, urging companies to exercise heightened vigilance during recruitment.

The following graphic illustrates the structure of internal infiltration and data risks posed by impersonating employees.

Multi-Layered Defense and the Future of Recruitment Processes

Interview Process Reform and Adoption of Technological Detection Tools

To prevent AI impersonation interviews, moving away from traditional reliance on “interviewer intuition” has become an urgent priority. Companies must implement a multi-layered defense strategy combining process, technology, and policy controls. In the selection process, holding up government-issued IDs to the camera for single-frame face verification during first-round interviews, along with asking highly specific, improvised technical questions that cannot be prepared in advance, is effective. Additionally, avoiding one-on-one interviews in favor of multi-interviewer panels and requiring mandatory in-person final interviews prior to issuing job offers are critical steps. Scientifically, to avoid relying solely on real-time video that suffers from latency and compression, uploading recorded interview data to specialized deepfake detection AI tools like “Spellbreaker” to analyze audio waveforms and frame-level micro-inconsistencies post-interview represents the most reliable approach. Furthermore, implementing reference checks and background checks rather than relying solely on candidate self-declarations is strongly advised.

The Future of Hiring Security and the Necessity of Public Authentication

Going forward, recruitment activities must be reframed not merely as talent acquisition, but as a critical component of “access management” that safeguards enterprise security. Especially in an era where remote hiring is established, stringent identity verification (identity assurance) is unavoidable. In Japan’s electronic Know Your Customer (eKYC) regulations, amendments to the Order for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds are scheduled for April 2027 (with the Act on Identification, etc. of Subscribers to Mobile Telecommunications Services amended in April 2026), abolishing the conventional “Method Ho” (capturing an ID image alongside facial photo). Moving forward, adoption will shift to Japanese Public Key Infrastructure (JPKI) methods such as “Method Ka” or “Method He,” which directly read IC chips in My Number Cards or driver’s licenses, rendering forgery and deepfakes physically impossible. Integrating strict pre-interview identity verification via IC chip reading into hiring workflows is certain to become the standard infrastructure for future recruitment.

Reference Pages

• [National Police Agency] Advisory on North Korean IT Workers for Nations and Enterprises: https://www.npa.go.jp/news/release/2026/20260731001.html
• [National Police Agency] 2025 Police White Paper Section 1: Trends and Countermeasures against Hostile Activities targeting Japan: https://www.npa.go.jp/hakusyo/r07/honbun/html/bb6621000.html
• [FBI IC3] Deepfakes and Stolen PII Utilized to Apply for Remote Work Positions: https://www.ic3.gov/

【#AIImpersonationInterview #Deepfakes #NorthKoreanITWorkers #Cybersecurity #HiringRisk #eKYC】