Vidoc Security Lab's deepfake job interview: two fake candidates (2024 to 2025)

the operator(s) likely used OSINT sources such as LinkedIn, company blogs, and funding-announcement coverage (Vidoc's $2.4M raise was publicly reported in October 2024) to identify Vidoc as an early-stage, security-focused, fully remote employer actively hiring for a Poland-based backend role. Vidoc also posted to Polish job boards such as JustJoinIT, where The Pragmatic Engineer notes the fakers were already active.

the operator(s) built fabricated candidate identities, including a polished CV, an active LinkedIn profile with real mutual connections, and, in the second incident, a real-time face-swap video filter. Vidoc's own ebook describes a wider pattern it observed across many applicants: identical CVs submitted under different Eastern European names, each tied to a freshly created LinkedIn profile with AI-enhanced photos, and in one case a home address that was a public court building.

per Vidoc's account, one persona approached the cofounders on LinkedIn before any role was open, asking if they were hiring, and followed up a couple of times before the company contacted him when the role went live. No source states a duration. Note the accounts disagree about which persona did this and when: Vidoc's blog and ebook attribute the outreach to the second persona, while The Pragmatic Engineer attributes a cold LinkedIn approach to the first fake profile and places it as early as February 2023.

fabricated CVs were submitted through Vidoc's normal job posting, and both personas passed an HR/operations screening call (15 to 30 minutes in the first case), exploiting the fact that early-stage screens are low-friction and not designed to catch identity fraud. Signals were already present and were not acted on: neither candidate spoke the language of the country he claimed to be from or to have taken a degree in.

the first persona performed exceptionally in a live, timed two-hour coding interview, becoming the first candidate to finish all tasks and follow-up questions inside the allotted time. The interviewer's assessment was that this reflected real engineering ability rather than assistance. The second persona never reached a technical assessment: he was challenged within minutes of turning his camera on.

in the second incident, the candidate first avoided video entirely by claiming a broken camera, forcing a reschedule, then joined with a real-time face filter active, which is the incident with a public recording. In the first incident, the candidate's camera was blurry and then froze; Vidoc believes a filter was in use but recorded nothing and has said it had no evidence.

in the second incident, the interviewer observed that the on-camera face did not match the LinkedIn profile picture, that the face did not sit correctly on the neck, and that answers came after a lag and were delivered as scripted, ChatGPT-style bullet points. That lag is a delay before answering, a tell for scripted or AI-assisted responses, and is distinct from the speech-to-video delay Vidoc reported in the first incident.

Moczadło started recording and asked the candidate to place a hand in front of his face, an occlusion test that real-time face filters handle poorly. The candidate asked whether it was a joke and refused outright; after insistence he raised his hand carelessly, in a way that did not actually cover his face, and the call was ended. No source reports that the filter visibly broke or glitched under occlusion: the test was never completed, and the interview ended on suspicion plus refusal. No liveness test appears in any account of the first incident, which was closed out by a non-technical background interview instead.

had either persona passed undetected, the goal was consistent with fraudulent employment, meaning securing an offer and onboarding to draw a salary under a false identity, with the added risk at a security company of gaining codebase/production access that could enable IP theft, backdoor insertion, or, per suspected DPRK-style overseas IT-worker schemes cited in reporting, sanctions-evasion revenue.