You Didn’t Fall for Phishing — You Actually Onboarded the Attacker
What if the star engineer that an organisation just hired is actually an attacker in disguise? This scenario is not about phishing; it involves infiltration through the onboarding process. Meet “Jordan from Colorado,” who possesses a strong resume, convincing references, a clean background check, and a digital footprint that checks out. On their first day, Jordan logs into email and attends the weekly standup, receiving a warm welcome from the team. Within hours, they gain access to repositories, project folders, and even some copy/pasted development keys for their pipeline. A week later, tickets close faster, and everyone is impressed. Jordan makes insightful observations about the environment, the tech stack, and which tools are misconfigured. However, Jordan was not who they claimed to be. The red-carpet welcome extended by the team was akin to handing a golden key directly to an adversary.
The modern con is no longer a malicious link in an inbox; it is a legitimate login inside an organisation. While phishing remains a serious and growing threat, particularly with the rise of AI-driven attacks, it is a well-known attack vector. Organisations have invested years in hardening email gateways, training employees to recognise and report malicious content, and conducting internal phishing tests. They defend against a flood of phishing emails daily, with a 49% increase in phishing incidents since 2021 and a 6.7x increase in the use of large language models to generate convincing emails. Despite these defences, Jordan gained entry through HR paperwork, not through phishing.
The issue of hiring fraud has become more pressing in recent years. Remote hiring has rapidly scaled, with industries realising that 100% remote work is feasible. Employees no longer require physical offices with easily defendable perimeters. Additionally, talented resources are available globally. While remote hiring expands the talent pool, it also eliminates the intuitive protections of in-person interviews, creating new opportunities for threat actors. Today, identity has become the new perimeter. This means that perimeters can be faked, impersonated, or even AI-generated. References can be spoofed, interviews can be coached or proxied, and faces and voices can be generated or deepfaked by AI. An anonymous adversary can convincingly present themselves as “Jordan from Colorado,” gaining access to an organisation’s sensitive information.
The threat of remote hiring fraud is not a distant concern or a mere cautionary tale. A report published in August of this year revealed over 320 cases of North Korean operatives infiltrating organisations through remote hiring practices. This highlights the urgent need for organisations to reassess their hiring processes and implement robust verification measures to safeguard against such threats.
Categories: Hiring Fraud, Remote Work Vulnerabilities, Identity Deception
Tags: Identity, Infiltration, Hiring, Fraud, Remote, Phishing, Security, Adversary, AI, Perimeter