Quick Summary
Jason Rebholz, CEO of an AI security startup, experienced a deepfake job application for a security researcher role. The candidate’s profile raised multiple red flags, including an anime profile picture and a resume hosted on Vercel. This incident highlights the growing risk of deepfake scams targeting companies of all sizes, with significant implications for cybersecurity and privacy.
The Securityish Brief
Jason Rebholz, co-founder and CEO of Expel, an AI security startup, faced a unique challenge when a deepfake candidate applied for a security researcher position. This incident occurred shortly after he posted job openings on LinkedIn, where he received a referral for a candidate whose profile picture appeared to be an anime character, marking the first sign of potential fraud.
Despite the initial red flags, including a resume hosted on Vercel, Rebholz proceeded with the interview. During the interview, the candidate joined with his camera off, only to reveal a blurry face and signs of deepfake technology, leading Rebholz to suspect he was being scammed. His experience reflects a broader trend where even small companies are targeted by sophisticated scams.
Rebholz’s experience is not isolated; major companies like Amazon have reported blocking over 1,800 suspected North Korean scammers from joining their workforce since April 2024. The rise of deepfake technology in job applications poses significant risks, as it can lead to security incidents and financial losses for organizations.
Rebholz emphasizes the importance of trusting one’s instincts and suggests practical measures to mitigate such risks. He advocates for keeping cameras on during interviews and avoiding virtual backgrounds, as well as verifying candidates through additional means.
Understanding the Risks of Deepfake Scams
The incident illustrates the growing sophistication of scams targeting the tech industry. Companies should be vigilant, as deepfake technology can easily deceive even experienced professionals. The potential for fraudsters to gain insider access to sensitive information poses a significant threat to organizational security.
Rebholz’s experience serves as a reminder that the risk of deepfake scams is not limited to large corporations; small businesses are equally vulnerable. Organizations must implement robust hiring practices to safeguard against these threats.
- Expel: An AI security startup where Jason Rebholz serves as CEO, facing a deepfake job application incident.
- Amazon: Blocked over 1,800 suspected North Korean scammers from joining its workforce since April 2024.
- Vercel: A cloud platform where the deepfake candidate’s resume was hosted, raising suspicion.
- North Korean IT Workers: A group known for applying to tech jobs using fraudulent identities.
- Claude: An AI tool that may have been used to generate the candidate’s resume.
Key Takeaways
- Always verify the authenticity of job candidates by checking their online presence and references.
- Require candidates to keep their cameras on during interviews and disable virtual backgrounds.
- If suspicious, ask candidates to provide real-time verification, such as picking up an item in their background.
- Implement a policy for new hires to work on-site for the first week, even if the position is remote.
- Educate your team about the risks of deepfake technology and encourage them to trust their instincts during the hiring process.
Key Terms & Concepts
- Deepfake: In this article, a deepfake refers to a synthetic media where a person’s likeness is digitally altered to create realistic video impersonations.
- Vercel: Vercel is a cloud platform for building applications that can integrate with AI tools, mentioned as the host for the candidate’s resume.
- North Korean IT Workers: North Korean IT workers are individuals from the Democratic People’s Republic of Korea known for applying to jobs using fraudulent identities.
- Claude: Claude is an AI tool that may generate resumes or portfolios, referenced in the context of the candidate’s application.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/02/01/ai_security_startup_ceo_posts/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
