Threat Actors Increasingly Exploit Deepfakes for Social Engineering
The availability of deepfake technology has given threat actors a valuable tool for social engineering attacks, according to researchers at BlackBerry.
“Typically, online scams prey on the presumed weaknesses and susceptibility of the targeted individual,” the researchers write.
“In previous decades, Internet fraudsters cast the widest possible nets to dupe the masses, as in the case of malspam (spam with malware), but as digital trends have evolved, so too have the tactics and techniques of online scammers.
Deepfakes may be the tipping point of the social engineering game, as it allows fraudsters to laser-focus on a specific individual for a fraction of the previous price point.”
BlackBerry cites a specific case that occurred earlier this year in which a deepfake was used to trick an employee into sending $25 million to criminals.
“In February 2024, a finance worker at a multinational firm was tricked into initiating a $25 million payment to fraudsters, who used deepfake technology to pretend to be the company’s chief financial officer,” the researchers write.
“According to Hong Kong police, the worker attended a videoconference with what he believed were real staff members, but who were in fact all deepfakes. The worker had initially been suspicious of a message that appeared to be from the corporation’s chief financial officer, requesting that a secret transaction be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like employees he recognized.”
New-school security awareness training can give your organization an essential layer of defense against evolving social engineering attacks.
“One of the strongest mitigation techniques is user awareness and education,” BlackBerry says. “Companies should implement a robust training program to educate employees about the threat of deepfakes, how they can be leveraged by cybercriminals, how to recognize them and what to do if suspicious, and the risks if a threat actor targets the organization using deepfakes. This user education can go a long way in reducing the deepfake attack surface….Employees who work in sales, finance, and HR should be particularly alert for fraudsters impersonating customers to access confidential client accounts and financial information.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
BlackBerry has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW