Most security teams train employees for phishing, malware and now with the advent of AI, wire transfer scams. Those reported have looked something like a cloned executive voice on a call, an urgent payment email request, and a well-intentioned finance employee who approves it quickly. Those attacks still happen and still work, but as always, attackers are adapting to find new ways to exploit people with access to information and cash.
Over the last several months, fraudsters started asking for a job. A salary, a laptop, and especially code repository access don’t require immediate payment authorization and trip fewer warning signs along the way.
Amazon’s chief security officer disclosed in December that the company had blocked more than 1,800 suspected North Korean applicants since April 2024, and that DPRK-affiliated applications were up 27 percent quarter over quarter. Applicants in these campaigns use AI to write resumes and build social personas, and face swapping to run the video interviews. In line with this, Gartner projects that one in four candidate profiles worldwide will be fake by 2028.
Released just this week, our own incident report for the first half of 2026 includes a deepfaked candidate who applied for a security researcher role at an AI security firm. The founder had studied deepfakes for years and used them in his own presentations. He knew within seconds of the camera turning on but he also never said so. He describes weighing his own near-certainty against the small chance he was wrong and would be costing a real person a job, and he let the interview run to the end. A detection vendor confirmed it afterward from the recording.
The generators got good, then cheap, then accessible
The reason fake candidates are on the rise is not that attackers collectively got smarter or left their cushy engineering gigs for a life of crime. The tools got better, the price collapsed to near zero or actually zero in the case of open
Haotian AI is a Chinese real-time face swap tool sold openly to anyone, including scammers, for $1,998 a year plus $498 per custom face. It plugs into Zoom, Teams and WhatsApp natively, and the vendor will install it for you, with staff filmed doing exactly that in an office building in Phnom Penh. A 404 Media investigation in May found that the leading academic deepfake detector misclassified nearly all of its output as authentic.
There are now more than 2.2 million model variants on Hugging Face, close to double the count a year ago. That is one of the reasons pattern-based detection is struggling to keep up. You cannot memorize the artifacts of a catalog that doubles every year, and researchers at the Vector Institute have documented the result, which is that detection accuracy drops sharply in deployment on content from generators the detector has not seen.
The capability is coming from the frontier labs, from Chinese labs, and from open weights. Open weights matter most here. A model you download has no refusal behavior you cannot strip, no rate limits, no abuse monitoring, and no account to suspend. Impunity is not a policy failure of any one company, but rather the result of capabilities shipping with zero controls.
How hard is it to fake an entire person? Unfortunately, not that hard.
Britain’s AI Security Institute ran a stress test on the newest models. They switched off the safety features deliberately, gave the models internet access, and told them to attack. They ran the challenge 122 times. Most runs were uneventful, but in ten of them the models went live and did real things to real people. AISI counted 19 unsanctioned actions and attributed most of them to a single frontier model.
What it was trying to do is get malicious code into a real openan was reviewing changes first. So it did not attack the code, it adapted and attacked the human. It invented fake developers, used them to approach the real maintainer, and pressured him toward approving the change. When it got challenged in public it edited its own trail to look innocent and started building a fresh identity to try again
The same style of attack has worked by playing on the empathy of everyday people. Scammers cloned OnlyFans creators with off-the-shelf tools, copied a creator’s voice and style, moved fans off-platform, and invented an emergency involving a child in the hospital. They asked for payment in Cash App and crypto, which made the transfers effectively irreversible. Fans have lost money, and some have turned up at creators’ homes after months of believing they were talking to a real person.
A face swapping model used to make it through the interview process and gen AI clones built to drain big-hearted follower savings are the same attack. Both of them won by creating a convincing version of a real human.
I ran the identity half of that myself, without the malware. I used Qwen 3.8 Max, an open model that costs about a tenth of a frontier model and matches or beats it on most benchmarks. I told it to create a persona and it did. It produced a full name and a twenty-year career history. It generated a photorealistic face of someone who has never existed. It built a GitHub account that looked lived-in, with repositories, a profile, and commit history, and then a matching LinkedIn profile.
Both accounts passed the platforms’ own sign-up and verification checks.
Fares Scheer does not exist. Qwen invented him, GitHub accepted him, and our detection model flagged the face at 99 percent synthetic on a single pass.
The same capability can be used as an excuse
Everything that makes a fake appear credible has also created a world where the truth is plausibly deniable. In our first-half report we tracked eleven incidents where fabricated content was believed and acted on. Three where genuine content was dismissed as AI-generated by people who didn’t want to act on it.
The second set is smaller and it is the one that is growing into a problem for all of us, because it is not an attack, but a defense. Critical recorded instructions, video authorizations, or voices on an emergency line could be dismissed with two words: “that’s AI.”
So is detection as valuable for finding deepfakes as it is for authorizing authentic communications and content transfers or uploads? We think so.
Practically, this translates into a few things.
First, treat detection as routing. It is a risk score that should be incorporated into workflows where trained, contextualized humans review, or is accepted or denied based on a very high confidence return.
Second, put verification where the decision happens. The hiring call, the payment authorization, the support line. Detection that runs after the fact is excellent for forensic use cases but is not useful in real-time communications or mission-critical decision making processes.
Third, audit and review the communication streams and content you already have. There may be content that was thought to be real that wasn’t, and content that was presumed fake that was authentic. Understanding whether you have a detection problem and what kind of content is the culprit is the foundation for improvement.
Most of the institutional response so far has been aimed at stricter code review, kill-switch bills, and pre-release government review of frontier models. All of that may be necessary, but none of it touches a $6 per million token open model that a scammer runs on rented hardware. The attacks will increasingly come from AI posing as people, not the code itself.
We can’t recall the open models or find a way to prevent people from finding new ways to attack businesses and individuals. But knowing what’s real is a really good place to start.
Zohaib Ahmed is the CEO and co-founder of Resemble AI, a deepfake detection model company.
