Here’s How Deepfake Vishing Attacks Work, and Why They Can Be Hard to Detect
Freeman writes:
By now, you've likely heard of fraudulent calls that use AI to clone the voices of people the call recipient knows. Often, the result is what sounds like a grandchild, CEO, or work colleague you've known for years reporting an urgent matter requiring immediate action, saying to wire money, divulge login credentials, or visit a malicious website.
Researchers and government officials [PDF] have been warning of the threat for years, with the Cybersecurity and Infrastructure Security Agency saying in 2023 that threats from deepfakes and other forms of synthetic media have increased "exponentially." Last year, Google's Mandiant security division reported that such attacks are being executed with "uncanny precision, creating for more realistic phishing schemes."
[...]
The Mandiant post showed the relative ease with which members of its security team executed such a scam in a simulated red team exercise, designed to test defenses and train personnel. The red teamers collected publicly available voice samples of someone inside the targeted organization who had employees report to them. The red teamers then used publicly available information to identify employees most likely to work under the person being faked and called them. To make the call more convincing, it used a real outage of a VPN service as a pretense for the employee to take immediate action.
[...]
Precautions for preventing such scams from succeeding can be as simple as parties agreeing to a randomly chosen word or phrase that the caller must provide before the recipient complies with a request. Recipients can also end the call and call the person back at a number known to belong to the caller. But it's best to follow both steps.
Read more of this story at SoylentNews.