David Head is CEO of Endorsed, a San Francisco identity verification startup that uses AI to screen candidates. That task includes detecting signs of potential imposters and fraudsters, which these days includes a torrent of North Korean operatives posing as IT workers, who over the past several years have snuck into hundreds of U.S. companies.
Endorsed, which Head co-founded with CTO Kevin Fu, has analyzed more than 11 million job applications for fraud and is backed by Joe Montana’s Liquid 2 Ventures, Pioneer Fund, and angels including Micah Smurthwaite, said Head. The firm analyzed a sample of 175,000 job applications for all role types in 2026 across U.S. companies ranging from three to 25,000+ employees, where the application was flagged as having mid-to high-risk patterns associated with North Korean IT worker schemes. If you aren’t aware, men from the Democratic People’s Republic of Korea have been forced to pose as workers seeking IT jobs so they can funnel their earnings into authoritarian ruler Kim Jong Un’s nuclear weapons program, according to the UN.
Among U.S.-based remote IT roles, where Head says the fraud is most concentrated, applications carrying those patterns went from 11% of the total in the third quarter of 2024 to 44% a year later. Endorsed estimates that, for the most recent quarter, the rate was a whopping 47%.
Endorsed, which surfaces risk signals for human review, found data showing that the current setup looks like this: North Koreans likely favor claiming to hail from Texas, which accounted for 26.5% of all flagged applications. California and Florida origins were also popular, accounting for 14.4% and 7.2% respectively. As for individual cities, the North Koreans’ most popular choices to claim as their own hometown included Dallas, Austin, and Houston.
The scammers are also partial when it comes to where they claim to have gone to school. The research reveals that the most popular purported alma maters for the North Koreans are the University of North Texas and UT Austin, followed by the University of Central Missouri and UT Dallas. As for past employers, the fake applicants are most likely to claim they worked at Amazon, Google, and Meta, while Capital One, CVS Health, Microsoft, and Stripe are popular choices too. As for first names, the North Koreans like to go by Sai, Michael, David, and Kevin. More than half included a LinkedIn profile.
If all of this sounds banal, that’s the point. The scammers pick familiar names, cities, employers and schools because it offers additional camouflage based on real job applicants, Head said.
“One or even several of these traits should never make an applicant seem suspicious on their own,” he noted. “The risk comes from a broader pattern of inconsistencies and behavior, not someone’s name or background.”
Thousands of North Korean workers have taken jobs at Fortune 500 companies undetected until they get caught and American accomplices are often part of the conspiracies. A New Jersey facilitator was sentenced to nine years in prison in April for spearheading a ring that put operatives inside more than 100 U.S. companies.
Despite the wave of North Korean fraud, venture capitalists are getting pickier and investing in fewer companies. Cybersecurity venture funding was flat at $8.5 billion in the first half of 2026, while deal count fell 23.8%, according to PitchBook’s Q2 2026 cybersecurity report. The second quarter’s $3.8 billion across 165 transactions was the most tepid since the end of 2024. Security operations led on deal count with 47 transactions worth $1 billion making up more than a quarter of all VC-backed cybersecurity funding. (Endorsed considers itself to sit at the cross-section of recruitment tech and cybersecurity, and Head calls it “an emergent category.”)
Among identity and access management, funding shriveled from $0.8 billion in Q1 to $0.3 billion in Q2. PitchBook attributes much of the pullback to the fear that some of these AI-native security startups will lose their luster in favor of frontier models like Anthropic’s Mythos. However, PitchBook is bullish on IAM given that nonhuman identities “outnumber humans roughly 45 to 1 in typical enterprises.”
And ultimately, using a checklist based on fraud patterns simply won’t be enough to verify identities and root out imposters. Endorsed’s model looks past biographical details and examines devices and networks, along with document and behavior signals, the company says, with a human required to sign off on decisions.
So when Head’s own co-founder and CTO, Kevin Fu, turned out to match several of the fraud patterns, Head couldn’t resist pointing it out. Fu grew up in a Dallas suburb, went to the University of Texas at Austin, and spent most of his career at LinkedIn, owned by Microsoft.
Every single one of those details aligns with data Head’s company provided exclusively to Fortune about people pretending to be American software engineers. Head volunteered the coincidence himself when he sent the figures over.
“We’ve scanned him with Endorsed though,” joked Head, “and I can verify that he is legitimate.”
See you later,
Amanda Gerut
[email protected]
Submit a deal for the Term Sheet newsletter here.
Joey Abrams curated the deals section of today’s newsletter. Subscribe here.
VENTURE CAPITAL
– Light, an Austin, Texas-based power company that embeds electricity products for businesses, raised $46 million in Series A funding led by Matrix. Activate Capital also invested.
– EIT Pharma, a Kirkland, Wash.-based biotechnology company developing therapies for infectious diseases including chronic hepatitis D, raised $35 million in Series A funding led by Propel Bio Partners. Good Ventures and Arrowtown also invested.
PRIVATE EQUITY
– Levine Leichtman Capital Partners acquired the Colt Group, a Pasadena, Texas-based provider of emergency repair services. Financial terms weren’t disclosed.
– Bernhard Capital Partners acquired Revenew, a Houston-based provider of contract compliance, profit recovery, and performance consulting services. Financial terms weren’t disclosed.
EXITS
– Aon agreed to acquire USI Insurance Services, a Valhalla, N.Y.-based insurance brokerage and consulting company, from KKR for $17 billion.
– ONEOK agreed to acquire the Permian Midland Basin natural gas gathering and processing assets of Brazos Midstream, a Fort Worth, Texas-based platform backed by Old Ironsides Energy and EnCap Flatrock Midstream, for $4.43 billion.
– SLB agreed to acquire Kelvion, a Herne, Germany-based provider of thermal management and cooling systems for data centers and industrial systems, from Apollo-managed funds and minority stakeholder Triton, for $4.1 billion.
IPOS
– The Wella Company, a New York City-based hair and nail products company, filed to go public on the New York Stock Exchange. The firm posted $2.94 billion in revenue for the year ending June 30, 2026, and net income of $2.7 million. KKR backs the firm.
