LastPass has revealed that hackers used deepfake audio to impersonate Karim Toubba, the company's CEO, and trick an employee in a voice phishing attack.
Fortunately, the LastPass employee did not fall victimbecause the attacker contacted him via WhatsApp, which is a very unusual communication channel in the business.
“In our case, an employee received a series of calls, texts, and at least one voicemail from an attacker impersonating our CEO via WhatsApp,” said LastPass intelligence analyst Mike Kosak.
See also: South Korea: Creates deepfake video detection tool
“As the communication attempt was outside of normal professional communication channels and due to the employee's suspicion that it was a social engineering (such as a sense of urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness about these threats.“.
LastPass stressed that this attack, using deepfake technology, was a complete failure and had no impact on the company. However, it wanted to share details to warn other companies and their employees that deepfakes are being used in executive impersonation campaigns.
The deepfake audio used in this attack was likely created through AI models trained on publicly available recordings of the LastPass CEO (e.g., interviews on YouTube).
Using Deepfake for Attacks: A New Major Threat
Before the LastPass deepfake attack, the US Department of Health and Human Services (HHS) warned that cybercriminals were targeting IT help desks using social engineering tactics and voice cloning tools to deceive their targets.
See also: United Kingdom: Deepfakes will jeopardize the elections
The use of audio deepfakes makes it difficult to verify the identity of the caller, making attacks more effective.
The Ministry recommends the following advice for protection against such attacks:
- Verification of employees requesting password resets and new MFA devices.
- Monitoring for suspicious ACH changes.
- Re-validation of all users with access to payer websites.
- Review of personal requests for sensitive matters.
- Requirement for supervisors to verify requests.
- Training staff to detect and report social engineering techniques and verify the identity of callers.
Protection is essential, given that such attacks can have serious consequences for companies:
Initially, attacks of this type can lead to significant financial losses. The losses may arise from the transfer of funds (after the fraudster's demand), lost sales, loss of customer trust, and increased costs to deal with the effects of the attack.
See also: Deepfake scam: How a fake conference call led to the theft of $25 million
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Deepfake attacks can also cause significant damage to corporate reputation (e.g. LastPass). Customers and investors may be disappointed with the company's ability to protect data , which can lead to a decrease in investment and customer loyalty.
Finally, these attacks can lead to legal repercussions for the business. If the business cannot protect its customers' personal data, it can face fines and legal disputes.
Source: www.bleepingcomputer.com
