Researchers Develop Real-Time Warning System for Deepfake Videoconferences as North Korean IT Workers Exploit Technology

Aug 3, 2026

On July 31, 2026, an eleven-nation coalition issued a coordinated alert warning that North Korean IT operatives, tracked as FAMOUS CHOLLIMA, are using real-time AI deepfakes to bypass live video job interviews. The scheme funneled $800 million to Pyongyang's weapons programs in 2024. Operatives use Western laptop farms to maintain remote access after hiring. In response, researchers at Fraunhofer SIT are developing a real-time warning system to detect video and audio deepfakes during videoconferences.

Real-time deepfake job interviews

▪The real-time deepfake technique involves running a face-swapping model as live video inference and routing the output through a virtual camera driver.
▪North Korean IT operatives are using real-time AI deepfake video to impersonate real people during live job interviews to bypass identity checks.

North Korean IT worker infiltration

▪North Korean operatives use large language models to generate resumes, LinkedIn profiles, and portfolio websites to build synthetic identities.
▪North Korean IT workers under the group FAMOUS CHOLLIMA accounted for 47% of all state-sponsored hands-on-keyboard intrusions against US technology companies in the year ending March 2026.

Laptop farm remote access

▪Proxies in Western countries operate laptop farms where they receive company-issued laptops and allow overseas North Korean actors to access them remotely.
▪Operatives use IP-KVM devices and remote administration tools like AnyDesk and TeamViewer to control physical machines located in American homes.

Cryptocurrency revenue laundering

▪In March 2026, the US Treasury Department blacklisted 21 cryptocurrency addresses across Ethereum and Tron blockchains connected to the North Korean IT worker scheme.
▪North Korean IT worker schemes funneled approximately $800 million to Pyongyang's nuclear weapons and ballistic missile programs in 2024.

Eleven-nation government alert

▪On July 31, 2026, eleven allied nations, including the US, Japan, South Korea, France, Germany, Italy, and the Netherlands, issued a coordinated alert regarding North Korean IT workers.
▪The July 31, 2026 advisory marks the first time France, Germany, Italy, and the Netherlands co-signed a joint warning on the North Korean IT worker threat.

US facilitator prosecutions

▪In May 2026, Matthew Issac Knoot and Erick Ntekereze Prince each received 18-month sentences for running laptop farms that generated $1.2 million for Pyongyang.
▪In April 2026, US residents Kejia Wang and Zhenxing Wang were sentenced to 108 and 92 months in federal prison respectively for operating laptop farms.