David Head is CEO of Endorsed, an identity verification startup in San Francisco that uses AI to vet candidates. That task includes spotting signs of potential fraudsters and fraudsters, which these days include a spate of North Korean agents who have a history of posing as IT workers several years have crept into hundreds of US companies.
Endorsed, which Head co-founded with CTO Kevin Fu, has analyzed more than 11 million applications for fraud and is backed by Joe Montana’s Liquid 2 Ventures, Pioneer Fund and angels like Micah Smurthwaite, Head said. The company analyzed a sample of 175,000 applications for all role types in 2026 at U.S. companies with three to more than 25,000 employees and found medium to high risk patterns in the applications North Korean IT employee programs. In case you don’t know, men from the Democratic People’s Republic of Korea were forced to impersonate them Workers looking for IT jobs so that they can invest their income in the nuclear weapons program of the authoritarian ruler Kim Jong Un, according to the UN.
Among U.S.-based remote IT roles where fraud is most concentrated, according to Head, the share of applications with these patterns increased from 11% of the total in the third quarter of 2024 to 44% a year later. Endorsed estimates the rate was a whopping 47% last quarter.
Endorsed, which uncovers human verification risk signals, found data showing the current situation is as follows: North Koreans likely prefer to say they are from Texas, which accounted for 26.5% of all reported applications. Countries of origin from California and Florida were also popular, at 14.4% and 7.2%, respectively. As for individual cities, Dallas, Austin and Houston were among the most popular choices for North Koreans to be their own hometown.
The scammers are also biased when it comes to where they supposedly went to school. The research shows that the most popular alleged alma maters of North Koreans are the University of North Texas and UT Austin, followed by the University of Central Missouri and UT Dallas. With previous employers, false applicants most often claim to have worked for them AmazonGoogle and Metawhile Capital one, CVS Health, Microsoftand Stripe are also popular options. When it comes to first names, North Koreans like to use Sai, Michael, David and Kevin. More than half included a LinkedIn profile.
If this all sounds banal, that’s the point. The scammers choose well-known names, cities, employers and schools because it provides additional cover based on real applicants, Head said.
“One or more of these characteristics should never alone make an applicant appear suspicious,” he noted. “The risk arises from a broader pattern of inconsistencies and behaviors, not from an individual’s name or background.”
Thousands of North Korean workers have taken jobs at Fortune 500 companies undetected until they were caught, and American accomplices are often part of the conspiracies. A New Jersey broker was convicted nine years in prison in April for lead a ring As a result, employees worked in more than 100 US companies.
Despite the wave of fraud in North Korea, venture capitalists are becoming more selective and investing in fewer companies. According to PitchBook’s cybersecurity report for the second quarter of 2026, funding for cybersecurity companies remained flat at $8.5 billion in the first half of 2026, while the number of deals fell by 23.8%. Second-quarter revenue of $3.8 billion across 165 deals was the weakest since the end of 2024. The security space led the way in deal count, with 47 deals worth $1 billion accounting for more than a quarter of all VC-backed cybersecurity funding. (Endorsed sees itself as the intersection of recruiting technology and cybersecurity, and Head calls it “an emerging category.”)
Identity and access management funding fell from $0.8 billion in the first quarter to $0.3 billion in the second quarter. PitchBook attributes the decline largely to fears that some of these AI-native security startups will lose their luster in favor of pioneering models like Anthropic’s Mythos. However, PitchBook is bullish on IAM because non-human identities “outnumber humans by about 45 to 1 in typical organizations.”
And ultimately, using a checklist based on fraud patterns simply won’t be enough to verify identities and weed out fraudsters. Endorsed’s model goes beyond biographical details to examine devices and networks as well as document and behavioral signals, requiring a human to sign off on decisions.
When it emerged that Head co-founder and CTO Kevin Fu matched several of the fraud patterns, Head couldn’t resist pointing them out. Fu grew up in a Dallas suburb, attended the University of Texas at Austin and spent most of his career at LinkedIn, owned by Microsoft.
Each and every one of these details corresponds to the data that Heads has provided exclusively to the company Assets about people pretending to be American software developers. Head announced the coincidence himself when he sent over the numbers.
“However, we have scanned him with Endorsed,” Head joked, “and I can confirm that he is legit.”
See you later,
Amanda Gerut
amanda.gerut@fortune.com
Submit an offer to the Term Sheet newsletter Here.
Joey Abrams curated the Offers section of today’s newsletter. Subscribe here.
RISK CAPITAL
– LightAn Austin, Texas-based energy company that embeds power products for businesses has raised $46 million in Series A funding matrix. Activate capital also invested.
– EIT Pharmaa Kirkland, Washington-based biotechnology company developing treatments for infectious diseases including chronic hepatitis D, has raised $35 million in Series A financing led by Propel organic partner. Good things to do And Arrow City also invested.
PRIVATE EQUITY
– Levine Leichtman Capital Partners acquired the Colt Groupa Pasadena, Texas-based provider of emergency repair services. Financial details were not disclosed.
– Bernhard Capital Partners acquired Renewa Houston-based provider of contract compliance, revenue recovery and performance consulting. Financial details were not disclosed.
EXITS
– Aeon agreed to the acquisition USI insurance servicesan insurance brokerage and consulting firm based in Valhalla, NY KKR for $17 billion.
– ONEOK agreed to acquire the Permian Midland Basin natural gas gathering and processing assets Brazos Midstreama Fort Worth, Texas based platform powered by Ancient Ironsides Energy And EnCap Flatrock Midstream, for $4.43 billion.
– SLB agreed to the acquisition Kelviona Herne, Germany-based provider of thermal management and cooling systems for data centers and industrial systems, from Funds managed by Apollo and minority shareholder Tritonfor $4.1 billion.
IPOS
– The Wella Companya New York City-based hair and nail products company, filed to go public on the New York Stock Exchange. The company reported revenues of $2.94 billion and net income of $2.7 million for the year ended June 30, 2026. KKR stands behind the company.