Deepfake Video Used to Impersonate Tokyo IT Executive in Job Interview
A person used a deepfake video and fabricated resume to impersonate Kenbun Yoshii, a Tokyo IT company executive, during an online job interview in March 2026. Multiple analysis firms determined the video was AI-generated, and experts suggest the incident may be connected to North Korean IT workers seeking employment at foreign companies.
What happened
On March 4, 2026, a logistics software venture company in Japan conducted an online casual interview for an engineer position. An applicant using a deepfake video presented himself as Kenbun Yoshii, a real IT engineer, with a resume containing Yoshii's actual work history and education.
The interviewer became suspicious after the conversation and confirmed with the applicant that he had not submitted an application or attended the interview. Through a social media profile link in the resume, the interviewer identified that the resume belonged to Kenbun Yoshii, a 41-year-old founder of Reunion Software in Tokyo.
Yoshii confirmed that his publicly available photos and videos were used to create an AI-generated deepfake. Three analysis firms—Nablas, Okta, and Tokyo University researchers—examined the interview video and determined it was a deepfake, noting unnatural transitions between the forehead and hairline, inconsistent eye positioning, and mismatched mouth movements with audio.
Reported impact
Yoshii described the experience as chilling and frightening. After posting about the incident on social media, he received multiple reports from other companies indicating that applicants using the same name had applied to their organizations.
Okta reported that over 6,500 cases have been confirmed globally in recent years of individuals believed to be North Korean IT workers using generative AI to falsify their identities in foreign company interviews, with some involving Japanese firms and evidence of money being transferred to North Korea.
Index analysis
Trend Micro analyzed servers used by North Korean cybercrime organizations in late 2024 and discovered deepfake technology experiments and numerous fraudulent resumes, particularly for full-stack engineer positions. The fake resume used in this case included full-stack engineer credentials, though Yoshii is not actually a full-stack engineer.
Security experts noted that while deepfakes could previously be detected through visual analysis such as head movements or hand gestures, the technology has advanced to a level difficult to distinguish with the naked eye. Experts recommend strengthening identity verification procedures through professional conversation validation and multiple authentication methods.
Governance controls
Trend Micro's specialist emphasized that North Korean IT worker impersonation has primarily spread in the US and Europe but Japan is no longer exempt, and firms must strengthen account authentication and in-person interview procedures. Researchers recommended professional conversation-based verification and multiple authentication methods as the most realistic current countermeasures.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.