Deepfakes are rapidly emerging as an efficient and increasingly sophisticated cyber security threat. These AI-generated videos, images and audio often look and sound authentic, making it difficult to distinguish them from real content. Poorly made deepfakes were once costly and time-consuming to produce, but with the advent of AI and machine learning, they have become much easier to create. In one instance, a UK company lost $243,000 from a deepfake disguised as a CEO’s voice. In another, hackers created a believable AI hologram to trick victims into joining a meeting. To make matters worse, these deepfakes are now being used to gain access to corporate networks and even spread disinformation.
Accenture’s Cyber Threat Intelligence (ACTI) team has tracked an upswing in the use and sophistication of deepfakes. In 2021, underground chatter shifted from ransomware schemes to include malicious use of deepfakes, such as bypassing security measures to gain access to corporate networks. In addition, investing in deepfake technology is becoming cheaper and more accessible, with some services now costing less than $40 a month to license their platform.
The advancing state of deepfakes can be attributed to a few factors. For one, cybercriminal underground has become much more professionalized, with greater availability of specialized tools, services and knowledge. This has enabled a new breed of criminals to specialize in deepfake crafting. Secondly, stolen, sensitive data from double-extortion techniques is flooding the internet and is making deepfakes increasingly convincing. Finally, cybercrime groups are now more flush with R&D and outreach budgets, which in turn helps to augment their social engineering capabilities.
To combat against deepfake fraud, ACTI suggests stopping, investigating the source, finding accurate information and understanding the original content. In addition, staff should always consider the motivations and reliability of those posting the information, check email addresses and links for spoofing, and review any potential images carefully. Organizations should also incorporate deepfake and phishing training into their security protocols and plan crisis communications before becoming a victim of a deepfake attack.
The person mentioned in this article is the CCO of crypto company Binance, who reported that a “sophisticated hacking team” used video from his past TV appearances to create a believable AI hologram that tricked people into joining meetings.
The company mentioned in this article is the UK-based firm that was tricked into losing $243,000 due to a deepfake replicating a CEO’s voice. Another company mentioned is Accenture’s Cyber Threat Intelligence (ACTI) team, which has studied the evolution of deepfakes over the past several years and believes that the malicious use of deepfakes is becoming increasingly widespread.
