Researchers Develop Real-Time Warning System for Deepfake Videoconferences as North Korean IT Workers Exploit Technology

On July 31, 2026, an eleven-nation coalition issued a coordinated alert warning that North Korean IT operatives, tracked as FAMOUS CHOLLIMA, are using real-time AI deepfakes to bypass live video job interviews. The scheme funneled $800 million to Pyongyang's weapons programs in 2024. Operatives use Western laptop farms to maintain remote access after hiring. In response, researchers at Fraunhofer SIT are developing a real-time warning system to detect video and audio deepfakes during videoconferences.

Real-time deepfake job interviews

• ▪The real-time deepfake technique involves running a face-swapping model as live video inference and routing the output through a virtual camera driver
• ▪North Korean IT operatives are using real-time AI deepfake video to impersonate real people during live job interviews to bypass identity checks

North Korean IT worker infiltration

• ▪North Korean operatives use large language models to generate resumes, LinkedIn profiles, and portfolio websites to build synthetic identities
• ▪North Korean IT workers under the group FAMOUS CHOLLIMA accounted for 47% of all state-sponsored hands-on-keyboard intrusions against US technology companies in the year ending March 2026

Laptop farm remote access

• ▪Proxies in Western countries operate laptop farms where they receive company-issued laptops and allow overseas North Korean actors to access them remotely
• ▪Operatives use IP-KVM devices and remote administration tools like AnyDesk and TeamViewer to control physical machines located in American homes

Cryptocurrency revenue laundering

• ▪In March 2026, the US Treasury Department blacklisted 21 cryptocurrency addresses across Ethereum and Tron blockchains connected to the North Korean IT worker scheme
• ▪North Korean IT worker schemes funneled approximately $800 million to Pyongyang's nuclear weapons and ballistic missile programs in 2024

Eleven-nation government alert

• ▪On July 31, 2026, eleven allied nations, including the US, Japan, South Korea, France, Germany, Italy, and the Netherlands, issued a coordinated alert regarding North Korean IT workers
• ▪The July 31, 2026 advisory marks the first time France, Germany, Italy, and the Netherlands co-signed a joint warning on the North Korean IT worker threat

US facilitator prosecutions

• ▪In May 2026, Matthew Issac Knoot and Erick Ntekereze Prince each received 18-month sentences for running laptop farms that generated $1.2 million for Pyongyang
• ▪In April 2026, US residents Kejia Wang and Zhenxing Wang were sentenced to 108 and 92 months in federal prison respectively for operating laptop farms