LinkedIn's Verified Spotlight Fires Too Late. The DPRK Cover Pool Is 32.

LinkedIn shipped Verified Applicant Spotlight in its February 2026 Hiring Release, and every Recruiter seat now shows a checkmark next to "verified" applicants. The badge fires at the Apply step. DPRK IT workers are placing via cold sourcing and InMail, well upstream of that gate, and the DOJ indictments through mid-2026 keep landing. If your threat model stops at the checkmark, you have moved the risk, not removed it.

Why the Verified Applicant Spotlight misses the actual attack surface

Verified Applicant Spotlight is an apply-stage filter that validates a candidate against LinkedIn's identity graph after they hit Apply on your job post. It does not run on candidates you source and InMail, and it accepts stolen-but-legitimate identities, which is exactly the DPRK operating pattern.

Three reasons the badge does not close the gap:

• It runs at the wrong step. Sourced candidates you InMail never trigger the applicant-verification flow. The trust signal literally does not exist on their profile from your side of the desk.
• Stolen identities pass identity checks. One facilitator ran the stolen identities of over 60 US citizens across more than 300 companies between 2020 and 2023, generating $6.8M in DPRK revenue. The SSN is real. The name is real. The KYC clears.
• Scale defeats profile-only verification. LinkedIn now reports 1.3B members, 17,000 new connections per minute, and 8,200 job applications per minute. A verification layer that leans on network trust cannot police a graph moving that fast.

Recent U.S. DOJ, FBI, and Treasury actions specifically call out fabricated credentials, stolen identities, and domestic facilitators as the operating pattern. The badge doesn't touch any of those inputs. In May 2026, DOJ sentenced two U.S. nationals to 18 months in prison for hosting laptop farms out of their homes on behalf of overseas North Korean co-conspirators, in a scheme that generated more than $5M in salary payments from victim companies.

$6.8M

The DPRK cover-persona pool is 32, not 163,000

In Refolk's index of professional profiles, exactly 32 people worldwide match the narrow "remote MERN full-stack/blockchain developer" phrasing DPRK personas favor in their headlines. The broader legit pool of engineers with React plus Node.js skills is 163,605. The DPRK-preferred niche is roughly 0.02% of the mainstream stack pool. That density mismatch is a sourcing signal on its own.

Legitimate senior engineers don't self-describe in bootcamp-course vocabulary. When a headline reads "Remote MERN Stack Developer | Blockchain | Web3" and the profile claims Singapore residency with a Lahore timezone, the phrasing itself is the tell. Karl Chong, the persona Nisos surfaced, claimed Singapore and a remote MERN role at US-based Mongrov Inc since May 2023, while freelancer accounts placed him simultaneously in the US and Turkey. The stack label, the geo, and the availability pattern all fit a template.

That's the shape of the problem. Now the three checks that actually work at the sourcing stage, before you burn an InMail.

Check 1: GitHub co-authorship against known DPRK persona lists

The cheapest, highest-signal check is a one-hop graph query on a candidate's public commits against Nisos and Mandiant persona lists. Manufactured contribution histories routinely co-author commits with previously identified DPRK-affiliated accounts. Researchers documented "nickdev0118" co-authoring with another suspected North Korean account, "AnacondaDev0120". That kind of link takes seconds to check and is invisible to any interview vibe-check.

The mechanism is boring and mechanical. The network reuses matured GitHub accounts and portfolio content from older personas to backstop new ones. When one persona burns, the code and the graph edges get grafted onto the next. Co-authorship survives that grafting because it lives in commit metadata, not in the repo README the operator controls.

What to actually do:

1. Pull the candidate's public GitHub. Enumerate co-authors across their top 20 repos.
2. Cross-reference against the published Nisos DPRK persona list and Mandiant UNC5267 indicators. UNC5267 is the cluster Mandiant analyst Michael Barnhart's team has tracked since 2018.
3. Run Ketman's open-source gh-fake-analyzer on the account. It flags account-creation-date anomalies, commit-time-zone drift, and the specific patterns Ketman documents in their suspicious-account guide.
4. Compare the GitHub account creation date to the LinkedIn profile's earliest experience. A GitHub that postdates a "10 years of experience" LinkedIn by seven years is a red flag on its own.

This is the exact gap Refolk closes for the sourcing step: describe the person in plain English, get a ranked shortlist with GitHub, LinkedIn, and open-web signals joined at the profile level, so co-authorship anomalies surface before you draft outreach.

Check 2: Identity coherence across three networks

Cross-network coherence asks whether the same person exists consistently across LinkedIn, GitHub, and the open web, with matching timelines, matching photos, and matching writing style. The DPRK failure mode is that the identity is real but the person isn't, so background checks come back clean while everything upstream of them is incoherent.

Concrete coherence tests, in order of cost:

• Reverse image search on the profile photo. Morphed images and stock composites recur across personas. The KnowBe4 operative used falsified credentials and morphed images to clear interview loops at a security-training vendor. If a security company got fooled, a Series A startup will.
• Timeline predates the account. A LinkedIn claiming a 2015 start date at a US employer, with a GitHub created in 2023 and zero pre-2023 web mentions, does not belong to a senior engineer.
• Writing-style drift. Compare the LinkedIn "About" section, a public README, and the first InMail reply. Legitimate candidates sound like themselves. DPRK personas often show a hard shift because different operators handle different surfaces.
• Absence of authentic social activity. 38 North's October 2025 analysis specifically calls out that inconsistencies or absence of authentic social media activity is often noticeable to the untrained eye. No conference photos, no meetup RSVPs, no tagged posts across a decade of claimed experience is itself the signal.

The identity is real. The person isn't. Background checks were never built to catch that.

The mechanism behind the coherence gap: DPRK operations run laptop farms in the US (the Christina Chapman case in Arizona is the canonical example, with co-conspirators Jiho Han, Chunji Jin, and Haoran Xu named in the indictment), which means the network egress looks American while the human doing the work is overseas. The digital exhaust of a real career, tagged photos, mutual connections at claimed employers, comments on former colleagues' posts, cannot be manufactured on a laptop-farm timeline.

Check 3: Residency-signal triangulation

Triangulate three residency signals (declared location, commit-time-zone pattern, and freelance-platform footprint) and treat any two-of-three mismatch as disqualifying at the sourcing stage. This is the single check that would have caught Karl Chong, whose LinkedIn claimed Singapore while freelancer accounts placed him simultaneously in the US and Turkey.

The three signals and how to read them:

• Declared location. LinkedIn city, GitHub bio location, resume header. These are the operator's story.
• Commit-time-zone pattern. GitHub exposes commit timestamps. A "San Francisco" engineer whose commits cluster 01:00 to 09:00 UTC is working an Asia daytime schedule. gh-fake-analyzer surfaces this automatically.
• Freelance-platform footprint. Upwork, Toptal, and Fiverr profiles are frequently linked from the same email or handle. If the same handle bills from three continents in one quarter, the story breaks.

In Refolk's index, the top-10 locations for the 32-profile "remote MERN blockchain" cover pool cluster in Pakistan (Lahore) and India, four each, with the remainder scattered. Those are the plausible-cover geographies DPRK personas most frequently impersonate, because they map to time zones and English-fluency assumptions US recruiters accept without follow-up. The absence of any US or European clustering in that specific micro-pool is itself a diagnostic.

Where the threat actually lands

Two of the personas Nisos tracked appear to be employed at companies with fewer than 50 employees. The Fortune-100 headlines are misleading. Seed and Series A startups without dedicated security teams are the fattest target, because they run remote-first, ship offer letters fast, and rarely re-verify after hire. That's where sourcing-stage triangulation matters most, because there is no security team downstream to catch it.

32

What to actually change in your sourcing workflow this week

Rewire the sourcing step around three checks that fire before InMail, not after apply. Concretely:

1. Retire the checkmark as a trust signal on sourced candidates. Verified Applicant Spotlight tells you nothing about someone you InMail'd. Do not let the presence of the badge reduce scrutiny.
2. Add a five-minute GitHub co-authorship check against the Nisos and Mandiant UNC5267 persona lists for every technical candidate before outreach. Use gh-fake-analyzer as a batch pre-filter.
3. Require cross-network coherence before scheduling. Reverse-image the photo, diff the GitHub creation date against the earliest LinkedIn experience, and skim the open web for any tagged activity older than the current persona.
4. Triangulate residency on any candidate whose stack matches the DPRK profile (MERN, remote, blockchain-adjacent). Commit time zones do not lie.
5. Downweight the narrow-niche vocabulary. "Remote MERN blockchain developer" as a self-description is a 32-profile global pool. Treat headline template-matching as a soft negative signal.

None of this replaces a real interview loop. It does mean the candidates who reach the loop have already survived the checks LinkedIn's badge was never designed to run.

FAQ

Does LinkedIn Verified Applicant Spotlight catch North Korean IT workers?

No, not in the sourcing path. Verified Applicant Spotlight fires when a candidate hits Apply on a posted job and validates them against LinkedIn's identity graph. DPRK IT workers are placing via cold outbound and InMail responses, where the badge is never triggered from the recruiter's side. Worse, the graph itself accepts stolen legitimate identities, which is the entire mechanism of the scheme documented in the 2026 DOJ actions.

What is the fastest single check to run on a suspicious candidate?

Run their GitHub through Ketman's open-source gh-fake-analyzer and cross-reference co-authors against the Nisos and Mandiant DPRK persona lists. Co-authorship links to known DPRK-affiliated accounts like "nickdev0118" and "AnacondaDev0120" are the highest-signal cheap check available. It takes under five minutes and beats any interview-stage vibe assessment.

Are small companies actually at higher risk than Fortune 100 firms?

Yes, per Nisos and Mandiant tracking. Two of the documented personas were employed at companies with fewer than 50 employees, and the operational pattern favors targets without dedicated security teams. Fortune 100 breaches get the headlines because they're newsworthy, but the base rate is heaviest at seed and Series A startups running remote-first with fast offer cycles.

How do I verify a remote engineer candidate without slowing down the pipeline?

Bake the three checks (contribution provenance, cross-network coherence, and residency triangulation) into the sourcing step, not the interview step. That is what Refolk does at query time: you describe the profile in plain English and the ranking already accounts for GitHub age, cross-source coherence, and location signal, so the candidates who reach your loop have cleared the bar before you ever wrote outreach.