Deepfake & Synthetic Media Documented incident

KnowBe4 hires a North Korean fake IT worker (2024)

KnowBe4 hired a North Korean operative using a stolen US identity and an AI-enhanced photo in 2024. Malware started on his laptop; it was contained in 25 min.

Social Engineering Examples·11 sources

In mid-2024, KnowBe4, a company that trains staff to spot social engineering, hired a principal software engineer who turned out to be a North Korean operative. He used a real but stolen US identity and an AI-enhanced stock photo, and passed four video interviews, a background check and reference checks. When his company Mac arrived, it started loading malware. KnowBe4 says its security team spotted it and contained the laptop in about 25 minutes. Status: Company disclosure, no data loss reported.

Key takeaways

Background checks passed because the identity was real. It just wasn't his.
The photo matched the person on video every time. The deception was in the identity, not a live deepfake.
Endpoint monitoring caught what hiring missed.
KnowBe4 says no malware ran and no data, code or systems were accessed.

The hire

Check	Result
Application	Real US identity, stolen; photo was an AI-enhanced stock image
Interviews	Four separate video calls; he matched the photo each time
Background check	Clear, because the identity was valid
References	Checked
Laptop	A company Mac shipped to him

Tip: a clean background check proves the identity exists. It doesn't prove the person in front of you owns it.

How he was caught

On 15 July 2024 at 9:55pm US Eastern time, KnowBe4's endpoint tools flagged odd activity on the new laptop: tampering with session history, moving suspicious files, running unauthorised software, and using a Raspberry Pi to help download an infostealer. The security team called him. He said he was troubleshooting his router, refused a video call and stopped responding. KnowBe4 says the device was contained by about 10:20pm.

KnowBe4 shared its findings with Mandiant and the FBI and published the story on 23 July 2024, followed by an FAQ and, in October, a list of changes to how it hires.

Why this matters

North Korea has placed IT workers in Western companies using stolen identities, both to earn money and to get inside networks. This case is unusual because the victim wrote it up in detail, and because it's a security awareness company. If a firm that teaches people to spot social engineering can be fooled at the hiring stage, anyone can. See synthetic identity and recruitment fraud.

What stops it

Check identity in person or with a live ID check, not just a background check.
Watch for laptop delivery mismatches, like shipping to an address that doesn't match the candidate.
Limit new hires' access until onboarding is complete.
Monitor new devices closely in the first days. That's what worked here.
Be wary of refusals to go on camera when something goes wrong.

See also Contagious Interview, another North Korean hiring-themed operation.

Common questions

Did KnowBe4 hire a North Korean hacker?

Yes. In 2024 it unknowingly hired a North Korean operative using a stolen US identity and an AI-enhanced photo.

Was KnowBe4 breached?

KnowBe4 says no. The laptop was contained in about 25 minutes, no malware ran, and no data or systems were accessed.

How did he pass the interviews?

He appeared on video himself, matching an AI-enhanced version of a stock photo, while using a real person's stolen identity for the background check.

Was this a deepfake?

Not a live video deepfake. The photo was AI-enhanced, but he appeared as himself on calls. The identity was stolen.

Sources

How a North Korean Fake IT Worker Tried to Infiltrate Us. KnowBe4 (Stu Sjouwerman) (primary). Original first-party incident report, published 2024-07-23, updated 2024-10-19 with hiring-process changes
North Korean Fake IT Worker FAQ. KnowBe4 (Stu Sjouwerman) (primary). Published 2024-07-25, updated 2024-07-27; clarifies no breach, no malware execution, no data access, and addresses press mischaracterization
Arizona Woman Sentenced for $17M Information Technology Worker Fraud Scheme that Generated Revenue for North Korea. United States Department of Justice, Office of Public Affairs (primary). Published 2025-07-24; reports Christina Marie Chapman's guilty plea, sentencing, and the scheme's updated revenue figure
Democratic People's Republic of Korea Leverages U.S.-Based Individuals to Defraud U.S. Businesses and Generate Revenue. FBI (primary). Government advisory on the broader DPRK IT-worker fraud scheme (stolen identities, laptop farms, revenue figures)
Staying a Step Ahead: Mitigating the DPRK IT Worker Threat. Google Cloud / Mandiant (primary). Threat-intel corroboration of the DPRK IT-worker playbook (tracked as UNC5267 activity cluster)
Security company KnowBe4 accidentally hires North Korea IT worker scam. Axios (secondary).
North Korean hacker got hired by US security vendor, immediately loaded malware. Ars Technica (secondary).
Cyber firm KnowBe4 hired a fake IT worker from North Korea. CyberScoop (secondary).
What Can Be Learned from KnowBe4's North Korean IT Hire?. InformationWeek (secondary).
KnowBe4 catches North Korean hacker posing as IT employee. TechTarget (secondary).
US arrests American and Ukrainian in North Korea-linked IT infiltration scheme. Reuters (secondary). Published May 16, 2024; earlier charging-stage coverage. The July 24, 2025 DOJ sentencing release above supplies the updated figures.

Cite this case

Social Engineering Examples. “KnowBe4 hires a North Korean fake IT worker (2024)”. Accessed 3 November 2026. https://socialengineeringexamples.com/knowbe4-fake-north-korean-it-worker-2024

Attack Chain & Defense

1Identity and persona sourcing

What happened

The documented incident involved a valid but stolen US citizen identity and supporting credentials.