Why identity checks need to continue after hiring and login
A large New Zealand business hired a remote IT contractor who passed the interview, presented identity documents, and had a company laptop shipped to a local address. The work got done. The contractor was a North Korean IT worker.
New Zealand’s National Cyber Security Centre (NCSC) described the case in its Cyber Threat Report 2026, released September 24. The worker used a false persona and fake identity documents, gave a New Zealand address, and recruited a New Zealand citizen to receive and operate the company laptop. After the company became suspicious, it contacted the NCSC and police. The contract ended. The worker then claimed to have commercially sensitive information and threatened to release it unless paid.
The case exposes a gap in remote work security: the person represented during hiring, the person physically at the device, and the person controlling the work may not be the same.
Hiring checks answer questions at a moment in time
Interviews, identity documents, background checks, equipment delivery, passwords, and multifactor authentication all serve a purpose. But none, on its own, establishes who is operating a computer throughout a months-long employment relationship.
An interview shows who appeared during that interview. A document check evaluates the identity evidence presented. Shipping a device to an address establishes delivery, not who will use it. MFA confirms control of credentials and a factor at login, not who remains at the keyboard afterward.
In the New Zealand case, fake documents and a local equipment handler defeated the link employers often assume exists between a verified applicant and a company laptop. These controls did not prove that the wrong person was in front of the device. They left that question open.
A global operation with evolving tactics
North Korean remote IT work is not new. Official warnings date to 2022, and a UN expert report estimated the operation generated between $250 million and $600 million annually. In August 2026, Federal News Network reported that an FBI official said investigators had identified a North Korean remote IT worker working for a federal agency. The agency and the details of the case were not disclosed.
The workers may perform legitimate work and use valid credentials, which can make them difficult to distinguish from other contractors through ordinary endpoint alerts alone. The risk can include sanctions exposure, unauthorized access, data theft, and extortion.
In September 2026, Silent Push reported a North Korean IT worker recruiting proxies in the United States, Europe, and Latin America. The proxy would appear on camera as the applicant’s face, while the worker could assist during interviews and remotely control a machine during technical assessments.
That creates a harder problem than simply checking whether the person on camera matches an ID. The person on camera may be the proxy. And a person sitting at a company laptop may not be the only person controlling it.
What common controls can and cannot tell you
Each control below answers a narrower question, and none of them, on its own, establishes the physical identity of the person actually at the endpoint while the device is in use.
| Control | What it can help establish | What it may leave open |
|---|---|---|
| Video interview | Who appeared on camera during that meeting | Whether that person later does the work |
| ID and background checks | Whether presented identity evidence passes the check | Whether the person using the device is the verified applicant |
| Shipping equipment to a verified address | Where the device was delivered | Who uses or remotely controls it |
| MFA or passkeys | Control of credentials and an authentication factor at login | Who operates the session afterward |
| Endpoint security | Suspicious software, processes, and device activity | A human using approved tools or remote access |
| Behavioral analytics | Changes from an established pattern | A proxy whose behavior becomes the baseline |
The NCSC’s advice includes interviewing candidates face to face and requiring new staff to collect equipment personally. These steps can strengthen the connection between the verified hire and the device. They also underline the remaining question: how does an organization maintain confidence in that connection after onboarding?
The hiring check verifies who you approved once. It was never built to verify who is still there months later.
Where continuous human verification fits
Picture the ordinary version of this problem: an enrolled employee steps away from their desk, and a different person sits down and starts using the machine. This is what continuous human verification looks like in practice, and it’s the scenario Guacamole™ is built for. Using on-device computer vision, it checks whether the enrolled person is still the one at the keyboard. When they walk away, the session can be protected. If someone else takes their place, privacy protections can respond, all without the facial processing ever leaving the endpoint.
That is a different situation from the one Silent Push described, where the enrolled proxy never leaves the camera at all while someone else operates the machine remotely. Guacamole addresses the first case: a human swap at the physical endpoint. It is not built to independently catch the second: a verified face sitting still while another person drives the session from elsewhere.
Enrollment and remote access still need their own controls
That distinction sets a real boundary on what continuous human verification can promise. If the wrong person is enrolled in the first place, Guacamole will keep faithfully verifying that person, not the applicant a company actually meant to hire. Strong, identity-verified enrollment and controls against unauthorized remote access still carry their own weight here. This signal complements hiring checks, MFA, passkeys, and endpoint security. It does not replace them, and it does not determine what a worker or remote operator is authorized to do, or establish a person’s nationality or intent from their face. Hummingbirds AI has written before about why a valid login is not the same thing as a trustworthy session, and the same logic applies to who was hired in the first place.
Continuous human verification, after the hire and the login
Remote work has widened the distance between the person a company approves and the people who may use or control its computers, which is exactly the distance continuous human verification is meant to shrink. The New Zealand case shows this can affect a reputable business with established hiring practices.
Organizations should verify applicants carefully, tie onboarding to the right identity, secure devices against unauthorized remote access, and monitor what accounts can reach. They should also consider whether their endpoint controls can tell when the authorized human has left or someone else has taken their place, which is precisely what continuous human verification is built to answer.
Continuous human verification is how it keeps going.
See how Guacamole responds the moment an enrolled user walks away, or someone else appears in their place.
Sources and further reading
- New Zealand NCSC, Cyber Threat Report 2026
- RNZ, North Korea uses remote IT worker to clandestinely earn NZ currency
- Silent Push, North Korean IT worker recruiting facilitators through Discord
- Federal News Network, FBI investigating North Korean remote IT staffer working for US agency
- UN Panel of Experts report (2024), via Radio Free Asia
- FBI, North Korean IT worker threats to U.S. businesses
