Loading story…
Researchers and security practitioners warned that attackers are using widely available AI tools to make social engineering more personalized and scalable. McAfee found that free vision models could infer where travel photos were taken with high accuracy, with Gemma3 27B identifying the correct city and country in 87% of tests and Qwen3 VL 30B reaching 91%, giving scammers enough location context to craft convincing phishing lures from social media posts. Separate reporting also described how public profiles, posted media, and voice samples can be harvested to build believable impersonation campaigns over phone and audio channels.
New research on AI voice phishing found that the effectiveness of scam calls depends more on the script and persuasiveness than on whether a voice sounds perfectly human. In a study of 4,100 U.S. adults, suspicion of AI-generated voices was common but detection accuracy was poor, and familiarity with AI tools did not significantly improve performance; across five scam scenarios, 16.5% of participants said they would comply or might comply, while a fake-relative-in-trouble scenario reached 36.1%. The findings indicate that defenders should emphasize out-of-band verification and stronger identity-proofing rather than relying on users to spot synthetic voice artifacts or other obvious signs of AI use.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Research discussed by Help Net Security found that people are generally poor at distinguishing AI-generated voices from human callers and that familiarity with AI tools does not significantly improve detection. The study of 4,100 U.S. adults concluded that caller persuasiveness was a stronger predictor of scam compliance than whether a voice sounded human.
An OSINT Team article described the growing threat of AI-powered social engineering using cloned voices, deepfake-style impersonation, public profile scraping, and automated outreach. It emphasized that attackers can scale personalized scams by exploiting familiarity and emotional urgency rather than relying on perfect realism.
McAfee researchers warned that freely available AI vision models can infer where photos posted to social media were taken, enabling more targeted social engineering. In McAfee testing, models identified travel photo locations with high accuracy, reducing the reconnaissance effort needed to personalize phishing lures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceosintteam.blog
Open sourceblog.knowbe4.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI is accelerating and scaling social engineering by automating reconnaissance, targeting, and victim engagement, reducing both the cost and skill required to run convincing phishing and fraud campaigns. One reported evolution is the use of **AI agents** to collect open-source intelligence and conduct live, interactive conversations with targets with minimal or no human involvement, enabling high-volume, continuously running scam operations that can adapt in real time. Deepfake-enabled impersonation is further eroding trust in voice and video communications, including calls and meetings, with examples cited of finance staff being deceived into transferring **millions** after interacting with fabricated “executives.” Recommended mitigations emphasize shifting from human-sense validation to process-based controls—e.g., enforced verification procedures, out-of-band checks, shared authentication phrases (“safe words”), and emerging *content provenance* approaches—because traditional, predictable detection models are increasingly strained by the speed, personalization, and adaptability of AI-driven attacks.
Jun 29, 2026
Multiple reports highlighted a surge in **AI-enabled social engineering** that blends convincing pretexts with increasingly effective lures to steal credentials, money, or sensitive data. One account described a near-miss **LinkedIn job/recruiter scam** in which an attacker impersonated a recruiter tied to a well-known tech brand and attempted to draw the target into a fraudulent hiring/workflow process, illustrating how professional networking platforms are being used to seed high-trust approaches and extract personal information. Separately, threat reporting cited a sharp rise in **fake CAPTCHA** lures—up **563% over 2025** per *CrowdStrike’s 2026 Global Threat Report*—as attackers shift away from older “malicious browser update” prompts toward CAPTCHA-themed interactions that can trick users into executing malicious steps or handing over access. ESET also warned that **deepfake voice** has lowered the barrier for **CEO/CFO impersonation**, supplier fraud, and account takeover attempts: attackers can clone a voice from short public audio samples (e.g., interviews, earnings calls, social media) and then target finance or helpdesk staff (often identified via LinkedIn) to pressure wire transfers or bypass authentication and KYC checks.
Jun 29, 2026
A new study from Australia’s national science agency demonstrates that attackers can now generate convincing synthetic voices from just a photo of a person’s face, bypassing traditional voice authentication systems. The FOICE (Face-to-Voice) technique leverages AI to estimate vocal traits from facial features, enabling scalable impersonation attacks. In tests, this method successfully fooled WeChat Voiceprint authentication in nearly all attempts after several tries, and current deepfake detection systems largely failed to identify the synthetic audio as fake, highlighting a significant gap in existing security controls. Meanwhile, law enforcement agencies are grappling with the rapid evolution of AI-powered cyber threats. The FBI has acknowledged that AI is narrowing the gap between cybercriminals and nation-state hackers, but faces challenges in adopting AI tools due to the sensitivity of its data. In Australia, federal police are developing AI systems to interpret online slang and emojis used by decentralized crime networks, which are increasingly leveraging technology to coordinate and glorify criminal activity. These developments underscore the urgent need for improved AI-driven defenses and detection mechanisms to counter both technical and social aspects of emerging cyber threats.
Jun 29, 2026