Loading story…
The FBI has issued a warning about a new wave of AI-powered phishing campaigns that leverage deepfake voice technology to impersonate high-ranking officials. These attacks combine smishing (SMS phishing) and vishing (voice phishing) techniques, using cloned voices to convincingly trick victims—often senior U.S. officials or executives—into divulging sensitive information or transferring funds. The increasing accessibility of AI tools has made it easier for cybercriminals to create highly realistic audio deepfakes, raising significant concerns for organizations and national security.
Whaling attacks, which specifically target top executives, are becoming more sophisticated by incorporating these AI-driven tactics. A recent example involved a hedge fund manager who was lured into a malware-laden Zoom meeting, resulting in the compromise of his email account and the fraudulent approval of $8.7 million in fake invoices. Senior executives are particularly attractive targets due to their authority, access to sensitive data, and tendency to bypass security controls, making the threat of AI-enhanced phishing and whaling attacks a critical concern for businesses and government entities alike.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The FBI issued a warning about a new wave of phishing attacks that combine text messages with convincing deepfake voice calls to impersonate senior U.S. officials. The agency advised stronger verification procedures, user awareness, and reporting to counter the threat.
A phishing campaign using smishing and AI-generated voice cloning to impersonate high-ranking U.S. officials has been active since at least April 2025. The operation targets senior government officials and their contacts to steal sensitive information or induce money transfers.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gartner found that AI-enabled deepfake impersonation is making social-engineering attacks more convincing across phone calls, video conferences, email, and text messages. Of 297 senior cybersecurity leaders surveyed, **41%** reported a deepfake-related employee audio-call incident and **36%** reported a video-call incident in the preceding 12 months; **79%** encountered phishing, spear-phishing, or business-email-compromise activity. A prominent example was the 2024 fraud against engineering firm Arup, where video-call impersonations of colleagues persuaded an employee to transfer more than **$25 million** to criminal-controlled accounts. Gartner urged organizations to replace training focused on spotting fakes with mandatory, out-of-band verification for sensitive requests. CISOs should apply phishing-resistant and risk-based identity controls to high-value workflows, correlate suspicious communications with identity, device, privilege, and payment activity, and extend incident-response plans to cover multimodal impersonation and compromised AI agents.
Sep 25, 2026
Researchers have demonstrated that advancements in artificial intelligence have significantly increased the risks associated with voice cloning, particularly in the context of vishing attacks. Using as little as five minutes of recorded audio, attackers can now generate highly realistic voice clones capable of engaging in real-time conversations. This technological leap allows threat actors to conduct sophisticated social engineering attacks, making it increasingly difficult for targets to distinguish between genuine and simulated voices. The NCC Group's research team has explored these capabilities, showing how AI-powered voice impersonation can be leveraged to compromise organizations and extract sensitive information. Their findings indicate that enterprises, employees, and individuals are all at heightened risk of falling victim to these attacks, which can be used to obtain personal information, financial data, or corporate credentials. The research included a demonstration of a real-time voice clone, underscoring the immediacy and realism of the threat. While the technical details of the exploit were withheld to prevent misuse, the researchers warned that some threat actors are likely already employing similar techniques. Vishing, or voice phishing, traditionally involves tricking targets over the phone, but the integration of AI voice cloning makes these attacks more convincing and harder to detect. Attackers may impersonate family members, IT staff, or other trusted individuals to manipulate victims into divulging sensitive information or granting remote access. The NCC Group's simulation services have highlighted the practical application of these techniques in real-world scenarios, emphasizing the need for organizations to update their social engineering prevention strategies. The research also points to the broader implications for security awareness training, as traditional cues for detecting fraud may no longer be reliable. The rise of deepfake vishing represents a significant evolution in the threat landscape, requiring both technical and procedural countermeasures. Organizations are advised to implement multi-factor authentication and robust verification processes to mitigate the risks posed by AI-driven voice impersonation. The findings stress the urgency for enterprises to reassess their security protocols in light of these emerging threats. As AI technology continues to advance, the potential for abuse in social engineering attacks is expected to grow, making proactive defense measures essential. The research serves as a warning that the line between authentic and artificial communication is becoming increasingly blurred, demanding heightened vigilance from both organizations and individuals.
Jun 29, 2026
Voice phishing is emerging as a major initial-access tactic as attackers impersonate employees, help-desk staff, and senior officials to steal credentials, capture one-time passcodes, and transfer MFA enrollment. U.S. government warnings and industry reporting describe malicious messaging and vishing campaigns that use phone calls, SMS, and collaboration platforms such as Microsoft Teams to manipulate targets into granting access to single sign-on and cloud environments. Group-IB and CIS both report that advances in synthetic speech, real-time voice transformation, and voice cloning are lowering the cost and skill barrier for these scams, while incident data cited by defenders shows vishing accounting for a growing share of intrusions. The technique has been linked to serious downstream compromises, including an alleged **ShinyHunters** breach at Harvard University in which attackers reportedly used voice phishing to bypass MFA and access **Microsoft 365**, **SharePoint**, and **Salesforce**, exposing roughly **115,000** records tied to alumni and development operations. Security guidance across the referenced reporting urges organizations to harden identity workflows rather than rely on user recognition of suspicious calls, with emphasis on phishing-resistant MFA such as **FIDO2**, stricter help-desk identity verification, protection of passkey enrollment, and monitoring for anomalous authentication and account-recovery activity.
Aug 21, 2026