The deepfake video call

MITRE describes phishing as social engineering delivered by electronic means. When it targets a specific person, company or sector, it is called spear-phishing². The voice variant uses a call or another form of spoken communication to get the user to give access to systems³.

Spear-phishing often relies on two levers: posing as a trusted source and creating a sense of urgency or alarm in the target³. For information gathering, MITRE also notes the sending of several messages that look urgent⁴.

The NCSC places the main gain of AI for attackers in social engineering¹. It also assesses that AI improves reconnaissance, meaning the search for information about a target to find a way in, and makes this step and social engineering more effective and harder to detect¹.

The case described here is a scenario without a source. A message arrives, signed by a superior, and proposes an online meeting. On screen, the participants look like colleagues you know and speak like them. The request is pressing and confidential: a payment to start without delay.

MITRE lists urgency among the attacker's levers³. The NCSC warns that language mistakes, long used to recognise a fake, are no longer enough¹.

Illustration (fictional message, neutralised):
[A "director" asks you to join a confidential meeting urgently
via hxxps://reunion-exemple[.]invalid/salle-12
and announces that a payment must be processed today.]

The sources make it possible to name the following elements.

• The first contact is a phishing message. MITRE specifies that it can go through email, through third-party services such as social networks, or through calendar invitations².
• Identity spoofing is used to make the sender credible: MITRE cites spoofing of the sender's address, which can fool the person as well as automated security tools².
• The reconnaissance phase prepares the target. MITRE classes phishing for information under the reconnaissance tactic, with the aim of collecting data rather than executing malicious code⁴.
• Generative AI can produce text, images or video¹.
• MITRE cites, among the levers of spear-phishing, the simulated trusted source and urgency³.

The NCSC assesses that the most sophisticated uses of AI will remain limited to actors with access to quality training data, expertise and resources¹. It adds that the spread of these capabilities on criminal markets will put them within reach of anyone willing to pay¹.

On the defence side, NIST has published a voluntary AI risk management framework, released on 26 January 2023, then, on 26 July 2024, a profile devoted to generative AI that helps organisations identify the risks specific to generative AI⁵.

Scattered Spider: fake IT staff on the phone

MITRE states that, during campaign C0027, the Scattered Spider group posed as legitimate IT staff on the phone. It thereby directed its victims to download a remote administration tool that let it control their machine³. The page gives no date for this campaign. It does, however, show the pattern shared with a faked video call: a trusted voice asking for an action.

Storm-1811: fake tech support

According to MITRE, Storm-1811 made calls posing as IT support, to get users to download and run scripts and other tools³. The page's references include a Microsoft Threat Intelligence report dated 15 May 2024³.

The control that matters

MITRE recommends, for this technique, verifying the caller's identity³. For a payment, this amounts to calling the person back on a channel you already know and executing nothing on the strength of an online meeting alone. Dual approval of transfers is an organisational measure that management puts in place. The sources in the set do not describe it.