AI Weekly Malaysia

Security researchers created a fake DeFi startup called Ballena Azul, advertised developer jobs, and hired three suspected North Korean operatives who submitted forged identity documents—including one edited with Google Gemini and carrying a SynthID watermark. The operatives cleared interviews, signed contracts, and were given work VMs with access to source code, illustrating how the hiring process itself is the attack vector.

Why: If you hire remote developers, especially for crypto or startup roles, this is a concrete playbook of what forged onboarding documents look like: mismatched addresses vs. bank locations, AI-edited IDs with SynthID watermarks, and stolen SSNs attached to someone else's license. Tighten your identity verification and limit source-code and infrastructure access until trust is established.