Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds

David Head is CEO of Endorsed, a San Francisco identity verification startup that uses AI to screen candidates.

That task includes detecting signs of potential imposters and fraudsters, which these days includes a torrent of North Korean operatives posing as IT workers, who over the past several years have snuck into hundreds of U.S. companies.

Endorsed, which Head co-founded with CTO Kevin Fu, has analyzed more than 11 million job applications for fraud and is backed by Joe Montana’s Liquid 2 Ventures, Pioneer Fund, and angels including Micah Smurthwaite, said Head.

The firm analyzed a sample of 175,000 job applications for all role types in 2026 across U.S. companies ranging from three to 25,000+ employees, where the application was flagged as having mid-to high-risk patterns associated with North Korean IT worker schemes .

If you aren’t aware, men from the Democratic People’s Republic of Korea have been forced to pose as workers seeking IT jobs so they can funnel their earnings into authoritarian ruler Kim Jong Un’s nuclear weapons program, according to the UN .

Among U.S.-based remote IT roles, where Head says the fraud is most concentrated, applications carrying those patterns went from 11% of the total in the third quarter of 2024 to 44% a year later.

Endorsed estimates that, for the most recent quarter, the rate was a whopping 47%.

Endorsed, which surfaces risk signals for human review, found data showing that the current setup looks like this: North Koreans likely favor claiming to hail from Texas, which accounted for 26.5% of all flagged applications.

California and Florida origins were also popular, accounting for 14.4% and 7.2% respectively.

As for individual cities, the North Koreans’ most popular choices to claim as their own hometown included Dallas, Austin, and Houston.

The scammers are also partial when it comes to where they claim to have gone to school.

The research reveals that the most popular purported alma maters for the North Koreans are the University of North Texas and UT Austin, followed by the University of Central Missouri and UT Dallas.

As for past employers, the fake applicants are most likely to claim they worked at Amazon , Google, and Meta , while Capital One , CVS Health , Microsoft , and Stripe are popular choices too.

As for first names, the North Koreans like to go by Sai, Michael, David, and Kevin.