Loading story…
Gartner found that AI-enabled deepfake impersonation is making social-engineering attacks more convincing across phone calls, video conferences, email, and text messages. Of 297 senior cybersecurity leaders surveyed, 41% reported a deepfake-related employee audio-call incident and 36% reported a video-call incident in the preceding 12 months; 79% encountered phishing, spear-phishing, or business-email-compromise activity. A prominent example was the 2024 fraud against engineering firm Arup, where video-call impersonations of colleagues persuaded an employee to transfer more than $25 million to criminal-controlled accounts.
Gartner urged organizations to replace training focused on spotting fakes with mandatory, out-of-band verification for sensitive requests. CISOs should apply phishing-resistant and risk-based identity controls to high-value workflows, correlate suspicious communications with identity, device, privilege, and payment activity, and extend incident-response plans to cover multimodal impersonation and compromised AI agents.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Gartner surveyed 297 senior cybersecurity leaders between March and May 2026 on social-engineering incidents and related defenses.
A Ferrari executive reportedly thwarted a deepfake voice attack by asking the caller about a book recommendation known to the genuine executive.
A finance employee at a multinational firm's Hong Kong branch was induced by a fraudulent video call impersonating the CFO and colleagues to transfer more than $25 million to scammer-controlled accounts. IT Pro identified the company as British engineering firm Arup.
A separate incident involved deepfake voice notes impersonating an executive to convince an employee to download malware.
Gartner reported that 41% of surveyed CISOs had seen a deepfake-related employee audio or phone-call social-engineering incident and 36% had seen one involving video calls during the prior 12 months. It advised independent verification for risky requests and stronger identity, payment, and incident-response controls.
Google warned that criminal groups were abusing Gemini and other large language models to research and target victims.
The FBI warned of a campaign in which attackers used text and voice communications to impersonate senior U.S. officials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI is accelerating and scaling social engineering by automating reconnaissance, targeting, and victim engagement, reducing both the cost and skill required to run convincing phishing and fraud campaigns. One reported evolution is the use of **AI agents** to collect open-source intelligence and conduct live, interactive conversations with targets with minimal or no human involvement, enabling high-volume, continuously running scam operations that can adapt in real time. Deepfake-enabled impersonation is further eroding trust in voice and video communications, including calls and meetings, with examples cited of finance staff being deceived into transferring **millions** after interacting with fabricated “executives.” Recommended mitigations emphasize shifting from human-sense validation to process-based controls—e.g., enforced verification procedures, out-of-band checks, shared authentication phrases (“safe words”), and emerging *content provenance* approaches—because traditional, predictable detection models are increasingly strained by the speed, personalization, and adaptability of AI-driven attacks.
Jun 29, 2026
A recent Gartner survey revealed that 62% of organizations have experienced deepfake attacks within the past year, highlighting the rapid adoption of AI-driven social engineering tactics. These attacks often involve the use of deepfake technology to impersonate executives, tricking employees into transferring funds or divulging sensitive information. Akif Khan of Gartner emphasized that social engineering remains a reliable attack vector, and the introduction of deepfakes makes it even more challenging for employees to detect fraudulent activity. Automated defenses alone are insufficient, as employees are now the frontline defense against these sophisticated impersonation attempts. The survey also found that 32% of organizations faced attacks targeting AI applications, particularly through prompt injection and manipulation of large language models (LLMs). Such adversarial prompting can cause AI chatbots and assistants to generate biased or malicious outputs, further expanding the threat landscape. Flashpoint analysts corroborate these findings, reporting that threat actors are actively discussing and deploying AI-powered tools in underground communities. These include specialized malicious AI models and AI-generated attack plans, which are being used to automate and scale cybercriminal operations. The most immediate threat identified is the use of AI to exploit human psychology, with attackers leveraging AI to create convincing phishing lures and fabricated realities that undermine traditional authentication methods based on voice and visual cues. Financial institutions are particularly vulnerable, as demonstrated by recent incidents where finance workers were deceived by AI-generated content. The rise of 'Dark GPTs' and Attack-as-a-Service (AaaS) offerings on the dark web further illustrates the commercialization and accessibility of AI-driven cybercrime. Security experts recommend a defense-in-depth approach, combining robust technical controls with targeted measures for emerging AI risks. AI-powered security awareness training is increasingly seen as essential, empowering employees to recognize and resist sophisticated social engineering attacks. Over 70,000 organizations are already leveraging such platforms to strengthen their human firewall. As generative AI adoption accelerates, organizations must remain vigilant against both direct deepfake attacks and indirect threats to AI application infrastructure. The evolving threat landscape demands continuous adaptation of security strategies to address the growing use of AI in cybercrime. Proactive threat intelligence and employee education are critical components in mitigating these risks. Organizations are urged to avoid isolated investments and instead implement comprehensive controls tailored to each new category of AI-driven threat. The convergence of deepfake technology, AI-powered phishing, and prompt-based attacks marks a significant escalation in the sophistication and scale of cyber threats facing enterprises today.
Jun 29, 2026
Cybercriminals are increasingly leveraging artificial intelligence to automate and enhance identity impersonation, making traditional security measures less effective. Attackers now use AI-generated voice messages and deepfakes to convincingly mimic executives and employees, enabling sophisticated business email compromise schemes and fraudulent financial transactions. The widespread availability of generative AI tools, combined with vast amounts of personal data from previous breaches, allows threat actors to craft highly personalized phishing messages and social engineering attacks that reference real company projects and colleagues, significantly lowering the barrier to entry for such operations. Security experts warn that AI-driven attacks are fundamentally changing the threat landscape, with phishing attempts becoming nearly impossible to detect and self-evolving malware presenting new challenges for defenders. The rise of digital doppelgangers and AI-powered adversaries underscores the urgent need for organizations to adopt zero-trust security models and advanced identity verification techniques, as conventional employee training and perimeter defenses are no longer sufficient to counter these evolving threats.
Jun 29, 2026