How would you even know if your “remote teammate” is real?

With all these stories floating around about fake remote IT workers — like the recent FBI bust involving North Korean operatives getting hired by U.S. companies I honestly started to question how we verify who we’re really working with. Some of them apparently used malware to steal company credentials while acting like normal devs on the team. That part messed me up. Have any of you worked on teams where remote contractors seemed a bit off? Or are there tools/processes your companies use to vet them better? Not trying to stir up paranoia, but this one made me pause.