Fake Recruiter Deepfake Scams: How Job Seekers and Employers Can Detect Them

What Is the WaterPlum Fake Recruiter Scam and How Does It Work?

Japanese, US, Australian, and German authorities issued a joint advisory on WaterPlum, a North Korean group that infiltrates job seekers' computers, harvests sensitive information, and steals cryptocurrency. It targets software developers and IT professionals, with members posing as recruiters who present attractive job opportunities. They often impersonate legitimate employers, including AI, crypto, or NFT companies, or approach victims through recruiting services. US and Japanese officials link the group to the 313 Bureau of North Korea's Department of Military Industry.

The interview process itself is the attack. During interviews, victims are told to download and run malicious files hosted on developer platforms and code repositories, often as a "coding assignment" or a fix for a video-conferencing problem. The malware, which the advisory names as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, includes remote-access tools and information stealers. It can take browser-stored credentials, clipboard data, keystrokes, screenshots, crypto private keys or seed phrases, and files on the PC or in shared folders, including ID and passport scans.

Investigators also noted that operators use AI face-swapping software during online interviews, then turn off their video citing "technical issues". Stolen ID images can be reused, too: the advisory says North Korean IT workers can use them to impersonate victims and generate foreign currency. Authorities also dismantled a "laptop farm" run by an enabler in Japan, a first for the country. Read the full Cybernews report.

Why Traditional Vetting Misses AI-Assisted Recruiter Scams

Standard advice such as "check their profile," "look them up," or "see if the company is real" assumes the attacker's setup is thin or obviously fake. WaterPlum impersonates real employers and recruiting services, and adds a live video call with a human face that appears to respond naturally. A face-swap running in real time defeats the one check most people still trust instinctively: "I saw their face, it was a real person talking to me."

That's the gap AI-content-verification tools are built for: catching manipulation that's designed specifically to pass a human glance. UncovAI's Video Detector runs frame-by-frame deepfake analysis, and its Meetings Protection bot works during the call itself.

Use Case: How Job Seekers Can Verify a Recruiter Before an Interview

A job seeker gets an unsolicited message from a "recruiter" at an appealing AI or crypto startup, and the conversation moves to a video call and a "technical assessment". UncovAI can be used at each step:

• 1Check the recruiter's profile photo with the Image Detector, which looks for pixel-level anomalies that reveal AI-generated or photoshopped images.
• 2Protect the live call. Add the Meetings Protection bot to Zoom or Microsoft Teams. It joins silently and flags synthetic audio or video in real time, invisible to other participants. For a recording, upload it to the Video Detector.
• 3Check the messages and materials. Paste recruiter messages, job descriptions or "offer letters" into the Text Detector, and run logos or screenshots through the Image Detector. Suspicious voice notes can go through the Audio Detector.
• 4Check suspicious links with the URL Phishing Detector, which flags deceptive and AI-generated fake sites. Note that WaterPlum hosts its malicious files on developer platforms and code repositories, so a link to a legitimate platform is not proof the file is safe.
• 5Never run the file. No verification tool replaces the core rule from the advisory: don't execute code from untrusted third parties, whether it's a coding assignment or a "fix" for a video-conferencing issue.

Prefer to check on the go? Send a suspicious image, audio clip or message to the WhatsApp or Telegram bot for an instant authenticity verdict, or use the browser extension to scan images, text and links on any page as you browse.

Use Case: How Employers Can Verify a Candidate Isn't a North Korean IT Worker

The scam runs in reverse too. In August, Huntress researchers identified five suspected cases of North Korean operatives being hired as legitimate remote workers at real companies. Their aim is to wire wages back to the regime, steal data, or plant malware from the inside. And because WaterPlum steals ID scans, a candidate's documents may belong to a real victim. For hiring teams, the same detection approach applies to inbound candidates rather than outbound recruiters:

None of this replaces standard hiring due diligence such as reference checks, work-authorization verification, and background checks. UncovAI detects AI-generated and manipulated media, so pair it with formal identity verification for official documents. It closes the specific gap that AI face-swaps are designed to exploit.

Which UncovAI Tool to Use

UncovAI's product suite covers every step of a recruiting scam. Each scan returns a percentage confidence score, with results in under a second.

Red Flags Checklist for a Fake Recruiter Interview

If you see two or more of these together, stop the process. Verify the company through its official careers page or main switchboard, not through contact details the "recruiter" gave you, before continuing. If you already ran a file, the advisory's guidance is to disconnect the device from the internet immediately, back up essential data, and assume sensitive information may already have been stolen.

Frequently Asked Questions

Sources

1. Cybernews: Job hunting? North Korean fake recruiters infected 30,000 devices (September 20, 2026)
2. Joint advisory on WaterPlum (Contagious Interview), Japan National Police Agency and partner authorities
3. Huntress: DPRK remote worker investigation
4. UncovAI products