{"id":3597,"date":"2026-09-01T12:10:13","date_gmt":"2026-09-01T12:10:13","guid":{"rendered":"https:\/\/www.vaultinsider.top\/?p=3597"},"modified":"2026-09-01T12:10:13","modified_gmt":"2026-09-01T12:10:13","slug":"half-of-remote-it-job-applications-now-carry-north-korean-fraud-patterns-startup-endorsed-finds","status":"publish","type":"post","link":"https:\/\/www.vaultinsider.top\/?p=3597","title":{"rendered":"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds"},"content":{"rendered":"

<\/p>\n

David Head is CEO of Endorsed, a San Francisco identity verification startup that uses AI to screen candidates. That task includes detecting signs of potential imposters and fraudsters, which these days includes a torrent of North Korean operatives posing as IT workers, who over the past several years have snuck into hundreds of U.S. companies.\u00a0\u00a0<\/p>\n

\n

Endorsed, which Head co-founded with CTO Kevin Fu, has analyzed more than 11 million job applications for fraud and is backed by Joe Montana\u2019s Liquid 2 Ventures, Pioneer Fund, and angels including Micah Smurthwaite, said Head. The firm analyzed a sample of 175,000 job applications for all role types in 2026 across U.S. companies ranging from three to 25,000+ employees, where the application was flagged as having mid-to high-risk patterns associated with North Korean IT worker schemes. If you aren\u2019t aware, men from the Democratic People\u2019s Republic of Korea have been forced to pose as workers seeking IT jobs so they can funnel their earnings into authoritarian ruler Kim Jong Un\u2019s nuclear weapons program, according to the UN.\u00a0<\/p>\n

Among U.S.-based remote IT roles, where Head says the fraud is most concentrated, applications carrying those patterns went from 11% of the total in the third quarter of 2024 to 44% a year later. Endorsed estimates that, for the most recent quarter, the rate was a whopping 47%.\u00a0<\/p>\n

Endorsed, which surfaces risk signals for human review, found data showing that the current setup looks like this: North Koreans likely favor claiming to hail from Texas, which accounted for 26.5% of all flagged applications. California and Florida origins were also popular, accounting for 14.4% and 7.2% respectively. As for individual cities, the North Koreans\u2019 most popular choices to claim as their own hometown included Dallas, Austin, and Houston.\u00a0<\/p>\n

The scammers are also partial when it comes to where they claim to have gone to school. The research reveals that the most popular purported alma maters for the North Koreans are the University of North Texas and UT Austin,\u00a0 followed by the University of Central Missouri and UT Dallas. As for past employers, the fake applicants are most likely to claim they worked at Amazon, Google, and Meta, while Capital One, CVS Health, Microsoft, and Stripe are popular choices too. As for first names, the North Koreans like to go by Sai, Michael, David, and Kevin. More than half included a LinkedIn profile.\u00a0<\/p>\n

If all of this sounds banal, that\u2019s the point. The scammers pick familiar names, cities, employers and schools because it offers additional camouflage based on real job applicants, Head said.\u00a0<\/p>\n

\u201cOne or even several of these traits should never make an applicant seem suspicious on their own,\u201d he noted. \u201cThe risk comes from a broader pattern of inconsistencies and behavior, not someone\u2019s name or background.\u201d<\/p>\n

Thousands of North Korean workers have taken jobs at Fortune 500 companies undetected until they get caught and American accomplices are often part of the conspiracies. A New Jersey facilitator was sentenced to nine years in prison in April for spearheading a ring that put operatives inside more than 100 U.S. companies.\u00a0<\/p>\n

Despite the wave of North Korean fraud, venture capitalists are getting pickier and investing in fewer companies. Cybersecurity venture funding was flat at $8.5 billion in the first half of 2026, while deal count fell 23.8%, according to PitchBook\u2019s Q2 2026 cybersecurity report. The second quarter\u2019s $3.8 billion across 165 transactions was the most tepid since the end of 2024. Security operations led on deal count with 47 transactions worth $1 billion making up more than a quarter of all VC-backed cybersecurity funding.\u00a0(Endorsed considers itself to sit at the cross-section of recruitment tech and cybersecurity, and Head calls it \u201can emergent category.\u201d)<\/p>\n

Among identity and access management, funding shriveled from $0.8 billion in Q1 to $0.3 billion in Q2. PitchBook attributes much of the pullback to the fear that some of these AI-native security startups will lose their luster in favor of frontier models like Anthropic\u2019s Mythos. However, PitchBook is bullish on IAM given that nonhuman identities \u201coutnumber humans roughly 45 to 1 in typical enterprises.\u201d<\/p>\n

And ultimately, using a checklist based on fraud patterns simply won\u2019t be enough to verify identities and root out imposters. Endorsed\u2019s model looks past biographical details and examines devices and networks, along with document and behavior signals, the company says, with a human required to sign off on decisions.\u00a0<\/p>\n

So when Head\u2019s own co-founder and CTO, Kevin Fu, turned out to match several of the fraud patterns, Head couldn\u2019t resist pointing it out. Fu grew up in a Dallas suburb, went to the University of Texas at Austin, and spent most of his career at LinkedIn, owned by Microsoft.<\/p>\n

Every single one of those details aligns with data Head\u2019s company provided exclusively to Fortune<\/em> about people pretending to be American software engineers. Head volunteered the coincidence himself when he sent the figures over.<\/p>\n

\u201cWe\u2019ve scanned him with Endorsed though,\u201d joked Head, \u201cand I can verify that he is legitimate.\u201d<\/p>\n

See you later,<\/p>\n

Amanda Gerut
amanda.gerut@fortune.com<\/p>\n

Submit a deal for the Term Sheet newsletter here.<\/p>\n

Joey Abrams curated the deals section of today\u2019s newsletter<\/em>.<\/em> Subscribe here.<\/p>\n

VENTURE CAPITAL<\/h3>\n

– Light<\/b>, an Austin, Texas-based power company that embeds electricity products for businesses, raised $46 million in Series A funding led by <\/span>Matrix<\/b>. <\/span>Activate Capital<\/b> also invested.<\/span><\/p>\n

– <\/b>EIT Pharma<\/b>, a Kirkland, Wash.-based biotechnology company developing therapies for infectious diseases including chronic hepatitis D, raised $35 million in Series A funding led by <\/span>Propel Bio Partners<\/b>. <\/span>Good Ventures <\/b>and <\/span>Arrowtown <\/b>also invested.<\/span><\/p>\n

PRIVATE EQUITY<\/h3>\n

– Levine Leichtman Capital Partners<\/b> acquired the <\/span>Colt Group<\/b>, a Pasadena, Texas-based provider of emergency repair services. Financial terms weren’t disclosed.<\/span><\/p>\n

– Bernhard Capital Partners<\/b> acquired <\/span>Revenew<\/b>, a Houston-based provider of contract compliance, profit recovery, and performance consulting services. Financial terms weren’t disclosed.<\/span><\/p>\n

EXITS<\/h3>\n

– Aon<\/strong> agreed to acquire <\/span>USI Insurance Services<\/b>, a Valhalla, N.Y.-based insurance brokerage and consulting company, from <\/span>KKR<\/b> for $17 billion.<\/span><\/p>\n

– ONEOK <\/strong>agreed to acquire the Permian Midland Basin natural gas gathering and processing assets of <\/span>Brazos Midstream<\/b>, a Fort Worth, Texas-based platform backed by <\/span>Old Ironsides Energy <\/b>and <\/span>EnCap Flatrock Midstream, <\/b>for $4.43 billion.\u00a0<\/span><\/p>\n

– SLB<\/b> agreed to acquire <\/span>Kelvion<\/b>, a Herne, Germany-based provider of thermal management and cooling systems for data centers and industrial systems, from <\/span>Apollo-managed funds<\/b> and minority stakeholder <\/span>Triton<\/b>, for $4.1 billion.<\/span><\/p>\n

IPOS<\/h3>\n

– The Wella Company<\/b>, a New York City-based hair and nail products company, filed to go public on the New York Stock Exchange. The firm posted $2.94 billion in revenue for the year ending June 30, 2026, and net income of $2.7 million. <\/span>KKR<\/b> backs the firm.<\/span><\/p>\n<\/div>\n

#remote #job #applications #carry #North #Korean #fraud #patterns #startup #Endorsed #finds<\/p>\n","protected":false},"excerpt":{"rendered":"

David Head is CEO of Endorsed,… <\/p>\n","protected":false},"author":1,"featured_media":3598,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3797,6383,6385,1377,719,544,6384,2459,6381,2266,1834,6382,892,1835,889],"class_list":["post-3597","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-finance-news","tag-applications","tag-carry","tag-endorsed","tag-finds","tag-fraud","tag-job","tag-korean","tag-north","tag-north-korea","tag-patterns","tag-private-equity","tag-remote","tag-startup","tag-term-sheet","tag-venture-capital"],"yoast_head":"\nHalf of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds - Finance News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.vaultinsider.top\/?p=3597\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds - Finance News\" \/>\n<meta property=\"og:description\" content=\"David Head is CEO of Endorsed,…\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.vaultinsider.top\/?p=3597\" \/>\n<meta property=\"og:site_name\" content=\"Finance News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-01T12:10:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/08\/endorsed-founders-2880x1920-1.jpg?w=2048\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\"},\"headline\":\"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds\",\"datePublished\":\"2026-09-01T12:10:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597\"},\"wordCount\":1117,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/endorsed-founders-2880x1920-1.jpg\",\"keywords\":[\"Applications\",\"carry\",\"Endorsed\",\"finds\",\"fraud\",\"job\",\"Korean\",\"North\",\"North Korea\",\"patterns\",\"private equity\",\"remote\",\"startup\",\"Term Sheet\",\"Venture Capital\"],\"articleSection\":[\"Finance News\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597\",\"name\":\"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds - Finance News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/endorsed-founders-2880x1920-1.jpg\",\"datePublished\":\"2026-09-01T12:10:13+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#primaryimage\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/endorsed-founders-2880x1920-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.vaultinsider.top\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/endorsed-founders-2880x1920-1.jpg\",\"width\":1200,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/?p=3597#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\\\/\\\/www.vaultinsider.top\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#website\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/\",\"name\":\"Finance News\",\"description\":\"Just another Finance News site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.vaultinsider.top\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.vaultinsider.top\\\/#\\\/schema\\\/person\\\/ed40724a3e5d482ce66781a042c3c31e\",\"name\":\"admin\",\"url\":\"https:\\\/\\\/www.vaultinsider.top\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds - Finance News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.vaultinsider.top\/?p=3597","og_locale":"zh_CN","og_type":"article","og_title":"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds - Finance News","og_description":"David Head is CEO of Endorsed,…","og_url":"https:\/\/www.vaultinsider.top\/?p=3597","og_site_name":"Finance News","article_published_time":"2026-09-01T12:10:13+00:00","og_image":[{"url":"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/08\/endorsed-founders-2880x1920-1.jpg?w=2048","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"5 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.vaultinsider.top\/?p=3597#article","isPartOf":{"@id":"https:\/\/www.vaultinsider.top\/?p=3597"},"author":{"name":"admin","@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e"},"headline":"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds","datePublished":"2026-09-01T12:10:13+00:00","mainEntityOfPage":{"@id":"https:\/\/www.vaultinsider.top\/?p=3597"},"wordCount":1117,"commentCount":0,"image":{"@id":"https:\/\/www.vaultinsider.top\/?p=3597#primaryimage"},"thumbnailUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/09\/endorsed-founders-2880x1920-1.jpg","keywords":["Applications","carry","Endorsed","finds","fraud","job","Korean","North","North Korea","patterns","private equity","remote","startup","Term Sheet","Venture Capital"],"articleSection":["Finance News"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.vaultinsider.top\/?p=3597#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.vaultinsider.top\/?p=3597","url":"https:\/\/www.vaultinsider.top\/?p=3597","name":"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds - Finance News","isPartOf":{"@id":"https:\/\/www.vaultinsider.top\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.vaultinsider.top\/?p=3597#primaryimage"},"image":{"@id":"https:\/\/www.vaultinsider.top\/?p=3597#primaryimage"},"thumbnailUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/09\/endorsed-founders-2880x1920-1.jpg","datePublished":"2026-09-01T12:10:13+00:00","author":{"@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e"},"breadcrumb":{"@id":"https:\/\/www.vaultinsider.top\/?p=3597#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.vaultinsider.top\/?p=3597"]}]},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.vaultinsider.top\/?p=3597#primaryimage","url":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/09\/endorsed-founders-2880x1920-1.jpg","contentUrl":"https:\/\/www.vaultinsider.top\/wp-content\/uploads\/2026\/09\/endorsed-founders-2880x1920-1.jpg","width":1200,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.vaultinsider.top\/?p=3597#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.vaultinsider.top\/"},{"@type":"ListItem","position":2,"name":"Half of remote IT job applications now carry North Korean fraud patterns, startup Endorsed finds"}]},{"@type":"WebSite","@id":"https:\/\/www.vaultinsider.top\/#website","url":"https:\/\/www.vaultinsider.top\/","name":"Finance News","description":"Just another Finance News site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.vaultinsider.top\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.vaultinsider.top\/#\/schema\/person\/ed40724a3e5d482ce66781a042c3c31e","name":"admin","url":"https:\/\/www.vaultinsider.top\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts\/3597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3597"}],"version-history":[{"count":0,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/posts\/3597\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=\/wp\/v2\/media\/3598"}],"wp:attachment":[{"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3597"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3597"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vaultinsider.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}