The Shocking Interview Question That Can Reveal Fake Remote Job Candidates

Spotting Deceptive Remote Job Applicants

At the recent RSA Conference in San Francisco, security experts alerted attendees to a sophisticated campaign by North Korean operatives infiltrating global companies through remote job applications. Adam Meyers, senior vice president of CrowdStrike's counter adversary division, shared insights into how thousands of North Korean workers have secured positions in Fortune 500 companies.

How They Do It

• AI Tools: These infiltrators utilize generative AI to create polished LinkedIn profiles and job applications.
• Collaborative Deception: During technical interviews, multiple collaborators may work together to solve coding challenges while one person handles video calls, often poorly.

An Unexpected Question

Meyers suggested a method to expose these candidates: asking an off-script question such as, "How fat is Kim Jong Un?" This question often leads to immediate termination of the call, as the candidate cannot risk making negative remarks about their leader.

Once hired, these infiltrators often perform well due to the collaborative efforts behind a single identity. FBI Special Agent Elizabeth Pelker noted that this success makes employers hesitant to dismiss suspected agents, with comments like, "Oh, but Johnny is our best performer. Do we actually need to fire him?"

The Goals of Infiltrators

The infiltrators aim to collect wages while gradually exfiltrating intellectual property in small amounts to avoid detection. Pelker recommends conducting coding interviews in a corporate environment to observe behavioral red flags.

Emerging Threats

The operation has evolved, with laptop farms in the U.S. allowing remote workers to spoof local IPs. In one instance, the FBI uncovered a farm in Nashville. Additionally, deepfake technology is being used to deceive hiring teams. Pelker emphasized that education and vigilance are essential defenses against these tactics, urging organizations to consider personal meetings whenever possible.

Stay Informed

For more insights and updates on security issues, consider subscribing to the TechRadar Pro newsletter.