Companies face “synthetic insider” attacks using AI deepfake workers

In short: Hackers are increasingly using AI-made fake employees, including deepfake video and audio, to get hired and access company systems.

What's going on

Some cyber attacks now start with a job application. The Financial Times reports that criminals are using AI to create “synthetic insiders”, people who look and sound real on video calls but are not who they claim to be.

A recent US Justice Department crackdown described a North Korean campaign where people used stolen identities to get remote jobs at more than 100 US companies. The US government said the operation used the identities of over 80 Americans and generated more than $5 million. Some US-based helpers were sentenced for running “laptop farms”, which are homes filled with computers that make a remote worker appear to be in the US.

This sits inside a bigger problem called insider threats, which includes both deliberate theft and simple mistakes. Verizon’s 2026 analysis found 12 percent of about 22,000 incidents worldwide involved internal actors. Fortinet said in a 2025 report that 62 percent of insider-related incidents came from human error or compromised accounts, like sending the wrong file or pasting sensitive data into unapproved AI tools.

What to watch

Companies are tightening hiring and access checks, especially for high-risk remote technical roles. Experts cited by the FT suggest using identity checks and deepfake detection tools, plus simple tests during interviews like asking a candidate to turn their head or wave. At the same time, some security tools monitor staff activity closely, like taking screenshots or tracking keystrokes, and experts warn this can hurt trust and push people to find workarounds. A practical focus is “least access”, meaning employees and AI agents only get the minimum permissions they need, like giving out fewer keys to the office.

Source: Financial Times