In May, as part of my documentary film production, we encountered “Austin” on an HR recruiting call. Thanks to some further detective work, we were able to prove that this was a face-swapped agent from North Korea, trying to infiltrate a U.S. cybersecurity company. I documented the entire Zoom drama and the subsequent inquiry in the 11-minute video below.
But I kept wondering: whose face was this operative actually wearing?
I initially tried some standard consumer verification tools to reverse search “Austin’s” visage such as SocialCatfish, PimEyes, and FaceCheck.ID. That led nowhere even as these somewhat sketchy platforms tried to extract money from me, anticipating my investigative urgency.
Then I discovered the InVid/WeVerify Chrome browser extension. It’s a European Union-funded project intended as an open-source intelligence tool specifically for journalists, fact-checkers and human rights defenders. In other words, a free verification “Swiss Army Knife” for professional misinformation debunkers.
I uploaded an excerpt of “Austin” interacting with Pindrop’s Katelyn Halbert on camera to an unlisted YouTube video. The InVid dashboard segmented the video into clean, high-resolution keyframes, which were then pushed through a Yandex (Russia’s Google) reverse image search. It led me to an unexpected source: a profile on the Russian dating platform Mamba.
The facial structures match incredibly closely — even that little groove between the nose and the lips. My hypothesis is that these threat actors are scraping public photos from unsuspecting people on non-Western social networks. It gives them the visual data they need to train their neural face-swap mask without triggering detection on corporate networks like LinkedIn. (Indeed, “Austin” has no headshot on his LinkedIn profile. And he never responded to my direct message notifying him that his identity had been stolen.)
While I’m surprised by how easy it is to engage in this deception, I’m also amazed by how a singular face on a distant foreign website can be paired using this level of pattern matching. The human perimeter is certainly thinning.
[July 31 Note: See the joint alert issued by a number of nations, including the USA via the FBI, on the North Korean IT worker infiltration threat, calling out specifically the use of this deepfake technology.]