Red Flags
What a hiring or security team can look for. None is proof on its own; follow the source links for the detail.
| Priority | Meaning |
|---|---|
| P1 | Hard to explain innocently. Escalate on this alone. |
| P2 | Strong. Investigate, and look for a second signal. |
| P3 | Common on its own. Counts only alongside others. |
Hiring and onboarding
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | The shipping address changes after hire Often to another state, with a family emergency as the reason | Query | GTIG, FBI 2024, TechTarget |
| P2 | Camera off, or a face that does not match the profile Or text chat in place of a video call | Query | FBI 2023, US 2022, SEAL |
| P2 | A small staffing vendor vouching for the candidate The vendor itself can be the front MageHire | — | HM4 |
| P3 | A contractor role, fully remote Avoids in-person onboarding | — | GTIG, US 2022 |
| P3 | A senior engineer with a long U.S. history and a template CV Software, full-stack or blockchain | Query | GTIG, US 2022 |
| P3 | Working hours that fit East Asia, not the claimed location | Query | US 2022, SEAL |
| P3 | A work history with no U.S. employers Written into the persona prompt so references cannot be checked domestically | — | HM4, HM2 |
| P3 | Recommends other candidates once hired Common among genuine hires; SEAL reports it used to place more workers | — | SEAL |
| P3 | Accepts a rate well below market without negotiating SEAL cites a 25 to 50 percent discount | — | SEAL |
| P3 | Output that swings sharply from one week to the next Consistent with one seat shared by several workers | — | SEAL |
| P3 | The CV's work history does not appear on GitHub No commits or repositories from the employers it names | — | SEAL |
The employer's endpoint
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | A hardware KVM on the issued machine PiKVM, TinyPilot, GLKVM | Query 1, Query 2, Query 3 | HM2, HM3, Nisos, GrumpyGoose |
| P1 | An EDID emulator or dummy HDMI plug Fitted alongside the KVM | Query | HM3 |
| P1 | North Korean internal-network clients on the machine NetKey, OConnect | Query | Flare, Chollima Group |
| P2 | Remote-access software on the corporate endpoint RustDesk, AnyDesk, TeamViewer, Google Remote Desktop | Query 1, Query 2, Query 3 | HM1, HM2, GTIG |
| P2 | Conferencing remote control used as the access path Zoom or Webex remote control; the Zoom artifact saveUserDisclaimer | — | HM2 |
| P2 | A virtual desktop or personal device in place of a shipped laptop BYOD access through a virtual machine | — | GTIG 2025 |
| P2 | The endpoint or SASE agent disabled by the employee | Query | DTEX, Huntress |
| P3 | Anti-idle or mouse-jiggling software Keeps an unattended laptop showing as active | Query | GTIG, DTEX, ReliaQuest |
The network path
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | Unrelated employees signing in from one address A laptop farm's shared line | Query | ReliaQuest, DOJ, GTIG, SEAL, SEAL |
| P2 | Astrill VPN exit addresses About 2,400 published by Spur; also hosting ranges or a country other than the claimed one Search the IPs | Query | GTIG, HM2, Spur, SEAL |
| P2 | A proxy server on a United States VPS fronting the whole team CCProxy, HTTP and SOCKS5 with per-user authentication | Query | HM2 |
| P2 | One identity in sessions from two countries at once | Query | GTIG, Microsoft, ReliaQuest |
| P3 | Residential proxy egress near the address of record IPRoyal and comparable services | Query | HM2, GTIG |
Identity verification
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | An Android emulator answering a verification challenge LDPlayer, with ShareX capturing the QR code off the screen | Query | HM2 |
| P1 | A virtual camera in place of a physical one VCAM, OBS virtual camera | Query | HM2 |
| P2 | A persona photograph that has been face-swapped or generated faceswapper.ai, instant-portrait.com | Query | HM2, Nisos, Flare, SEAL |
| P3 | A history of changing legal names Identity rotation across documents and accounts | — | SEAL |
The interview
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | One person's voice on another person's call Voicemeeter Banana routing audio between two machines in the same meeting | Query | HM2, Group-IB |
| P1 | References who are other personas Assigned in advance in the identity dossier | — | HM2, Nisos |
| P1 | A different GitHub, email or social profile visible on a shared screen Not the one the CV gives | — | SEAL |
| P1 | Resigns and blocks every account rather than send a verification selfie Asked for a photograph taken where the candidate claims to live | — | SEAL |
| P1 | Can't speak their claimed native language A candidate presenting as Japanese, asked in Japanese | — | SEAL |
| P2 | Teammates assisting a live interview off camera Three behind one caller, with live transcription | Query | HM4 |
| P2 | Different people attending as the same employee Client meetings handed between operatives | — | HM4 |
| P2 | Refuses to repeat a phrase critical of Kim Jong Un And ends the call rather than say it | — | SEAL |
| P3 | Scripted answers read aloud An answer bank carrying phonetic pronunciation guides | — | HM2, Group-IB |
| P3 | A CV fitted too exactly to the job requirement Written within hours of the requirement being shared | — | HM4 |
| P3 | A biography rehearsed on an AI interview tool ChatGPT script, MockWise practice | — | HM4 |
| P3 | A stock video background, often the Golden Gate Bridge The backdrop recurs across unrelated candidates | — | SEAL |
| P3 | Keeps avoiding in-person meetings Repeated excuses, and reluctance to accept a promotion or an on-site invitation | — | SEAL, SEAL |
Accounts and contact details
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | One-time codes relayed by someone else The second factor sits with a facilitator, who posts codes in team chat | — | HM4 |
| P1 | A VoIP line in place of a carrier number Google Voice, slynumber.com, hushed.com; Skype historically | Query 1, Query 2 | HM2, FBI 2025, GTIG, Phone lines |
| P2 | Multi-factor codes generated in a browser 2fa.live and comparable sites | Query | HM2 |
| P2 | A professional-network session moved between machines The Cookie-Editor extension, used to import LinkedIn session cookies | Query | HM2 |
| P2 | A forwarding rule pointing outside the persona Configured before the account is handed over | — | HM1 |
| P2 | LinkedIn or GitHub accounts a few months old Against a decade of claimed experience See the queue | Query | Candidates, SEAL |
| P3 | Accounts stood up on bulk verification services sms-man.com, sms-activate.org, mailforspam.com | Query | HM2 |
| P3 | The address on the CV is not the address that applied An older address on the resume PDF, a fresh Gmail on the application | — | HM1, HM2 |
| P3 | An anti-detect browser holding one profile per persona ixBrowser, each profile behind its own proxy | Query | HM4 |
| P3 | A GitHub account created after the commits it hosts Years of history predate the account, often cloned with the .git author data edited | — | SEAL, SEAL |
| P3 | A sudden change of name or GitHub handle, or deleted social accounts Especially after questions start | — | SEAL |
| P3 | A pull request pushed from a different account than usual Another worker on the same seat | — | SEAL |
| P3 | A dormant or taken-over account that suddenly builds activity Often about two years of history before the first application | — | SEAL |
Data access
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | Company source code pushed to personal repositories Precedes extortion when a placement ends | Query | FBI 2025 |
| P1 | Company source code cloned to a personal computer or cloud account Repositories copied off company systems to a machine or account the worker controls | — | FBI 2025 |
| P3 | Password notes and broad file browsing | Query | DTEX, Huntress |
Payment and paperwork
| Priority | Indicator | Hunt query | Source |
|---|---|---|---|
| P1 | Pay split or redirected after hire To a third party, a wallet, an account in another name, or through a "manager" | Query | HM2, Nisos, US 2022, FBI 2024 |
| P2 | Payroll into a stablecoin-backed virtual account HuruPay and comparable services | — | HM2, Group-IB |
| P3 | A corp-to-corp engagement through an entity formed around an American A certificate of formation and a W-9 where an I-9 and a licence would be | — | HM2, GTIG |
| P3 | Asks to be paid in cryptocurrency | — | SEAL |