In 2025, the tech world hit a strange milestone. While most debates focused on whether AI would replace jobs, a more immediate problem emerged: AI started taking them literally. By year’s end, 41% of IT leaders admitted they had accidentally onboarded a fraudulent candidate.
This wasn’t about exaggerated résumés or padded experience. It was something far more dangerous: the Deepfake Colleague.
Deepfake impersonation is part of a broader shift toward AI-driven manipulation, similar to the risks we explore in When AI Agents Go Rogue. As the Q1 2026 hiring season approaches, the familiar “vibe check” over Zoom is no longer a security control, it’s a liability. For CTOs and SaaS founders hiring remotely, the challenge has shifted. It’s no longer just about finding capable talent. It’s about proving that the talent actually exists.
That remote engineer with a flawless GitHub profile and confident interview presence may look like a strong hire. But if they’re an AI-assisted proxy or a stolen identity wrapped in a convincing persona, they aren’t an asset. They’re a Trojan horse with legitimate credentials and access to your production systems.
Your 2026 Hiring Strategy:
- Why “fraudulent hires” are the next big insider risk
- How deepfake candidates and proxy interviews actually work
- Australian incidents that show how identity trust gets abused
- Why IAM, not interviews, is the real line of defence
- How Zero Trust changes onboarding for 2026
1. The Fraudulent Hire Is the New Insider Threat
For years, insider threats were framed as disgruntled employees or careless contractors. That model is outdated.
The modern version is quieter and far more deliberate: a person who never intended to do legitimate work in the first place. Their goal is access. Code repositories. Customer data. Financial systems. Internal conversations. Once inside, they don’t rush. They blend in.
Remote work has made this easier. Video interviews feel personal, but they’re easy to manipulate. Résumés are now AI-polished by default. References are increasingly unverifiable. And when hiring managers are under pressure to fill roles fast in Q1, scrutiny drops just enough to matter.
What makes this dangerous isn’t the initial deception. It’s what happens after onboarding, when access expands and trust compounds automatically.
2. How Deepfake and Proxy Hiring Schemes Actually Work
These attacks aren’t science fiction, and they’re not always sophisticated. They’re effective because they exploit process gaps, not technical ones.
In many cases, the person you interview isn’t the person who shows up on day one. Attackers use proxy interviewees, skilled speakers who pass technical rounds, while the actual account holder is someone else entirely. Sometimes that person is offshore. Sometimes it’s a criminal group rotating access.
More advanced operations now use AI-assisted video manipulation to maintain continuity. Voice cloning smooths out inconsistencies. Real-time deepfake overlays mask facial differences. None of this needs to be perfect. It just needs to be “good enough” for a 45-minute Zoom call.
Once hired, the attacker logs in from a different environment, different device, different geography, and most organisations still treat that as normal remote work variance. IAM systems grant access because credentials are valid. MFA passes because the attacker controls the session. No one questions it.
At that point, this isn’t a hiring mistake. It’s an identity failure.
3. Australian Incidents That Show How Trust Gets Abused
The Canva Insider Access Case
While Canva hasn’t publicly framed its incidents as fraudulent hires, investigations into insider-access misuse highlighted how credentialed users, legitimate or otherwise, can abuse trusted access to reach sensitive systems. Once access is granted through standard identity pathways, behaviour blends into normal activity unless continuously validated.
This mirrors what fraudulent hires rely on: legitimate access behaving illegitimately, just slowly enough to avoid alarms.
Service Desk and Identity Abuse in Australian SMEs
Australian SMEs have repeatedly suffered breaches where attackers gained access by impersonating employees during onboarding or role changes. In several cases reported by IR firms, attackers convinced service desks to reset credentials or provision access using partial identity information gathered from LinkedIn and email threads.
These weren’t advanced exploits. They were trust failures. And they worked because identity was treated as a one-time check, not an ongoing condition.
When the attacker already “is” an employee on paper, the barrier to abuse is dramatically lower.
Australian Case Studies: The High Cost of the “Ghost Engineer”
We’re already seeing the consequences of this shift in Australia.
In a 2024 incident involving a Melbourne-based fintech, a “Senior DevOps Engineer” was hired remotely following several strong video interviews. On paper, everything checked out. Two weeks in, the engineering lead noticed something odd. The pull requests were technically sound, but the engineer was never available for spontaneous huddles, quick calls, or unscheduled troubleshooting.
An internal review revealed the truth. The individual interviewed was a deepfake persona used to mask access by a North Korean–linked group seeking persistent entry into financial infrastructure. The access wasn’t noisy or rushed. It was patient and methodical. By the time the breach was identified, the firm had no choice but to rebuild its production environment from the ground up. The real cost wasn’t the salary, it was lost time, trust, and system integrity.
A different pattern emerged at a Sydney-based digital agency during a mid-2025 hiring round. An internal audit later showed that 83% of applicants for a single mid-level role had submitted AI-generated résumés tied to stolen or synthetic identities. One candidate progressed to the final interview stage before a simple request, turning their head to the side, caused the deepfake overlay to glitch, briefly revealing a different face underneath.
These aren’t fringe cases or internet folklore. They reflect a growing reality for Australian tech companies. Our high salaries, mature SaaS ecosystem, and strong remote-work culture make us an attractive target. Attackers don’t need to breach your perimeter if they can walk through the front door with an offer letter.
4. Why IAM Is the Real Gatekeeper, Not HR
Here’s the uncomfortable truth: no amount of interview diligence can solve this problem.
Humans are bad at spotting synthetic identities, especially when time-boxed and distracted. Identity & Access Management systems, however, are very good at spotting inconsistencies, if they’re configured to care.
Modern IAM should answer questions your hiring process can’t:
- Is this user accessing systems from a device they’ve never used before?
- Does their login behaviour match their role, location, and working hours?
- Are they authenticating through a legitimate session, or riding a stolen token?
- Is access expanding faster than role justification allows?
In 2026, IAM isn’t about granting access. It’s about proving identity continuously. That’s why identity assurance features prominently in the 2026 CISO Priority List, particularly during periods of rapid onboarding.
If your IAM stack still treats onboarding as a single event, create account, assign role, move on,you’re assuming trust where none has been earned yet.
5. Zero Trust and the Future of Onboarding
Zero Trust gets misunderstood as a network concept. In reality, it’s an identity philosophy: never assume legitimacy, always require verification.
Applied to hiring, Zero Trust means new employees start with minimal access, regardless of seniority or urgency. It means sensitive systems require step-up verification even after login. It means behaviour matters more than job titles.
Most importantly, it means identity is validated continuously, not just during the first week.
This approach doesn’t slow down real hires. It protects them. When access decisions are automated, contextual, and reversible, security teams don’t need to rely on gut feel or manual reviews. They rely on evidence.
For SaaS companies scaling fast in Q1, this is the difference between safe growth and invisible compromise.
Conclusion
The 2026 hiring season will be the most challenging yet for founders and CTOs. The objective isn’t just to fill seats quickly. It’s to ensure those seats aren’t occupied by ghosts, proxies, or malicious actors quietly embedding themselves into your organisation.
Stopping remote hiring isn’t realistic, and it isn’t necessary. The real shift needs to happen in how you treat identity. Hiring can no longer be viewed as a pure HR function. It’s a critical security entry point, and it needs the same level of scrutiny as production access or customer data.
That means gaining agentic visibility across your identity landscape. You need confidence, not assumptions, about who is accessing your systems, from where, and under what conditions. Identity must be continuously verified, not trusted by default.
This is exactly where Aeora Lab’s SAAI platform fits. It’s designed to help security leaders bring clarity to an increasingly blurred identity perimeter, giving you visibility into every agent, human or AI, that interacts with your environment.
