Threat Actors Increasingly Exploit Deepfakes for Social Engineering

The availability of deepfake technology has given threat actors a valuable tool for social engineering attacks, according to researchers at BlackBerry.

“Typically, online scams prey on the presumed weaknesses and susceptibility of the targeted individual,” the researchers write.

“In previous decades, Internet fraudsters cast the widest possible nets to dupe the masses, as in the case of malspam (spam with malware), but as digital trends have evolved, so too have the tactics and techniques of online scammers.

Deepfakes may be the tipping point of the social engineering game, as it allows fraudsters to laser-focus on a specific individual for a fraction of the previous price point.”

BlackBerry cites a specific case that occurred earlier this year in which a deepfake was used to trick an employee into sending $25 million to criminals.

“In February 2024, a finance worker at a multinational firm was tricked into initiating a $25 million payment to fraudsters, who used deepfake technology to pretend to be the company’s chief financial officer,” the researchers write.

“According to Hong Kong police, the worker attended a videoconference with what he believed were real staff members, but who were in fact all deepfakes. The worker had initially been suspicious of a message that appeared to be from the corporation’s chief financial officer, requesting that a secret transaction be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like employees he recognized.”

New-school security awareness training can give your organization an essential layer of defense against evolving social engineering attacks.

“One of the strongest mitigation techniques is user awareness and education,” BlackBerry says. “Companies should implement a robust training program to educate employees about the threat of deepfakes, how they can be leveraged by cybercriminals, how to recognize them and what to do if suspicious, and the risks if a threat actor targets the organization using deepfakes. This user education can go a long way in reducing the deepfake attack surface....Employees who work in sales, finance, and HR should be particularly alert for fraudsters impersonating customers to access confidential client accounts and financial information.”

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

BlackBerry has the story.