When the Applicant Isn't Who They Claim to Be: Why Infiltration Prevention Matters Now

For years, security teams have focused on keeping attackers from breaking in. A new class of threat actor has found an easier path, getting hired. Using stolen identities, fabricated resumes, and AI-generated personas, adversaries are applying for real jobs, passing interviews, and walking away with company-issued laptops, credentials, and trusted access to corporate environments. This isn't a fringe concern. Court records show that hundreds of Fortune 500 companies have unknowingly hired thousands of North Korean IT workers in recent years, and the problem is accelerating as generative AI makes fake identities cheaper and more convincing to produce.  

The Opening Shots

The North Korean IT worker scheme is the clearest example of how damaging this can be. These operations, in which North Korean nationals obtain remote IT jobs at US companies using fake or stolen identities, are estimated to have generated more than $88 million over six years. The money is only part of the story. Beyond collecting salaries, these workers have accessed and stolen sensitive information, including export-controlled US military technology and cryptocurrency. The FBI has also warned that these actors are using their unlawful network access to exfiltrate proprietary data and conduct revenue-generating activity for the regime. To pull this off, they rely on accomplices running "laptop farms" on US soil. In one case, a convicted facilitator received company laptops addressed to a stolen identity and installed unauthorized remote desktop software so North Korean workers could appear to be a legitimate US-based employee. The scheme is also spreading geographically, with CrowdStrike reporting new laptop farms established in Western Europe supporting fake developers supposedly based in Romania and Poland.  

Abnormal AI's Approach

The core problem is that traditional security tools engage too late. Identity and access platforms are built to flag suspicious behavior from employees, not to question whether a candidate is a real person. By the time a background check raises a flag, or a first login trips an alert, the attacker already has the badge, the laptop, and the access. Abnormal AI's Infiltration Prevention closes that gap by moving detection to the front of the pipeline. It integrates with the applicant tracking system, so every new identity is analyzed as soon as it enters the pipeline, before anyone is provisioned. Rather than trusting what's on the resume, it examines the metadata a recruiter never sees: mismatches between a candidate's name and email address, phone numbers tied to known VoIP or burner services, the same identity being used across many applications, suspicious IP addresses, and questionable email domains. As discussed in our recent briefing with Abnormal, a resume can be flawless and every detail can check out, but the metadata is often what gives a synthetic identity away. Abnormal sums up the principle well: a fraudster can fake a résumé and a face, but it's far harder to fake the accumulated behavior of the real person being impersonated.  

What makes this approach especially valuable is that it gets smarter across the entire customer base. Fraud patterns found in one organization's hiring pipeline sharpen detection for every Abnormal customer, which matters because these campaigns are run at scale, with the same infrastructure, phone numbers, and personas reused across many targets. Over the past 18 months, Abnormal's threat intelligence team has flagged roughly 3,500 fraudulent personas attempting to enter organizations through hiring and investigated about 1,000 more. Abnormal also shared that it plans to introduce write-back into HR systems, allowing suspicious applicant records to be flagged as malicious directly in the tools recruiters already use. That proactive approach is important, because it puts security findings in front of HR at the moment a hiring decision is being made rather than after the fact.  

The Attack Surface is Expanding

The same fraud pattern is hitting higher education, where "ghost students" enroll in classes under fake or stolen identities to collect financial aid and then vanish. The scale is staggering. California Community Colleges reported that 31.4% of all applications to the state's 116 community colleges in 2024 were fraudulent. Nationally, the Education Department's Office of Inspector General has investigated more than $350 million in confirmed fraud, has over 200 investigations open, and suspects some schemes exceed $1 billion. The impact extends beyond dollars. In one Bay Area example, a 50-person online class filled up in minutes with 100 people on the waitlist, and only six turned out to be real students. The signals that expose a fake job applicant, such as reused identities, masked locations, disposable contact details, and suspicious infrastructure, are the same signals that can expose a fake student, which makes this a natural area for the technology to extend into. 

What's Old is New Again

These attacks aren't sophisticated; in fact, they are so basic that they require us to return to the early days of email security. Maintaining lists of known bad senders, compromised domains, checking for VPN routed IP addresses, and other early techniques were the gold standard before trained models took over. Now with integrations into the right systems, these controls have returned to stop one of the fastest growing fraud schemes we're seeing in the wild. 

Conclusion

Whether the target is a corporate hiring pipeline or a college admissions office, the lesson is the same: identity verification can no longer be a one-time checkbox handled by HR or enrollment staff alone. Fraudulent identities are now an industrialized attack vector, and they need to be treated as a security problem from the very first interaction. Infiltration Prevention gives organizations a way to catch these personas before they're handed credentials, devices, or funding, and it does so by building on behavioral signals that attackers find much harder to fake than a document or a face. For any organization that hires remotely or enrolls applicants online, that early visibility could be the difference between a rejected application and a costly breach.