SC-075: AI Deepfake CEO Impersonation Attack¶
Scenario Overview¶
| Field | Detail |
|---|---|
| ID | SC-075 |
| Category | Social Engineering / AI Threats / Financial Fraud |
| Severity | Critical |
| ATT&CK Tactics | Reconnaissance, Resource Development, Initial Access, Impact |
| ATT&CK Techniques | T1566 (Phishing), T1656 (Impersonation), T1598 (Phishing for Information), T1585.001 (Establish Accounts: Social Media), T1657 (Financial Theft) |
| Target Environment | Multinational corporation, executive communications, treasury operations, video conferencing platforms |
| Estimated Impact | $4.2 million wire transfer fraud via deepfake CEO impersonation during live video conference; compromise of executive trust relationships; regulatory reporting obligations |
Narrative¶
Pinnacle Industries International (PII), a fictional Fortune 500 manufacturing conglomerate with 28,000 employees and operations across 14 countries, processes approximately $890 million in monthly outbound wire transfers through its centralized Treasury Operations Center in Chicago. The company's CEO, Margaret Chen (fictional), is a high-profile executive who frequently appears in earnings calls, industry conferences, and media interviews — generating hundreds of hours of publicly available audio and video content.
In March 2026, a financially motivated threat actor group designated PHANTOM FACE conducts a sophisticated deepfake social engineering attack targeting PII's VP of Treasury Operations, David Kowalski (fictional). The attack uses real-time AI-generated video and voice cloning to impersonate CEO Margaret Chen during a Microsoft Teams video call, instructing Kowalski to execute an urgent $4.2 million wire transfer to a "confidential acquisition escrow account."
PHANTOM FACE spent eight weeks preparing the attack — harvesting training data from public sources, fine-tuning deepfake models, and conducting reconnaissance on PII's organizational structure and financial processes. The attack succeeds because the deepfake quality is sufficient to pass casual visual inspection, the scenario exploits legitimate business urgency (a time-sensitive acquisition), and PII's wire transfer authorization process relies heavily on executive verbal approval without mandatory out-of-band verification for transactions under $5 million.
Attack Flow¶
graph TD
A[Phase 1: Reconnaissance<br/>Harvest CEO public video/audio data] --> B[Phase 2: Deepfake Model Training<br/>Voice cloning + face synthesis]
B --> C[Phase 3: Target Profiling<br/>Identify VP Treasury + authorization limits]
C --> D[Phase 4: Infrastructure Setup<br/>Spoofed Teams account + mule accounts]
D --> E[Phase 5: Social Engineering<br/>Deepfake video call with VP Treasury]
E --> F[Phase 6: Wire Transfer Execution<br/>$4.2M to attacker-controlled account]
F --> G[Phase 7: Detection<br/>Real CEO unaware of call]
G --> H[Phase 8: Response<br/>Transaction reversal + forensics]Phase Details¶
Phase 1: Reconnaissance and Data Harvesting¶
ATT&CK Technique: T1598 (Phishing for Information), T1593 (Search Open Websites/Domains)
PHANTOM FACE systematically collects publicly available audio and video content of CEO Margaret Chen to train their deepfake models. Sources include quarterly earnings call recordings, keynote presentations at industry conferences, television interviews, podcast appearances, and corporate YouTube videos. The attackers also conduct LinkedIn reconnaissance to map PII's organizational structure and identify high-value targets in the finance department.
# Simulated reconnaissance data collection (educational only)
# Publicly available content harvested for deepfake training
SOURCE INVENTORY — Margaret Chen (CEO, Pinnacle Industries)
========================================================
Source | Duration | Quality | Type
Q4 2025 Earnings Call (YouTube) | 47 min | 1080p | Video + Audio
Q3 2025 Earnings Call (YouTube) | 52 min | 1080p | Video + Audio
Manufacturing Summit 2025 Keynote | 38 min | 4K | Video + Audio
CNBC Interview — Oct 2025 | 12 min | 1080p | Video + Audio
Bloomberg Technology — Aug 2025 | 8 min | 1080p | Video + Audio
PII Annual Report Video Message | 4 min | 4K | Video + Audio
Industry Podcast (3 episodes) | 2.5 hrs | N/A | Audio only
LinkedIn Live Q&A — Dec 2025 | 22 min | 720p | Video + Audio
---------------------------------------------------------------
TOTAL TRAINING DATA: ~4.2 hours video, ~6.8 hours audio
# Organizational reconnaissance (LinkedIn OSINT)
Target: David Kowalski, VP Treasury Operations
Reports to: CFO Robert Tanaka
Direct reports: 8 (Treasury analysts, payment processors)
Authorization: Wire transfers up to $5M with single-party approval
Location: Chicago HQ, 14th floor
Teams status: Usually online 7:30 AM - 6:00 PM CT
Phase 2: Deepfake Model Training¶
ATT&CK Technique: T1585.001 (Establish Accounts: Social Media Accounts — infrastructure preparation)
PHANTOM FACE uses commercially available (and modified open-source) AI tools to create high-fidelity deepfake models of CEO Margaret Chen. The voice cloning model is trained on 6.8 hours of audio data, achieving a speaker similarity score sufficient to fool casual listeners. The real-time face synthesis model is fine-tuned on 4.2 hours of video, enabling live face-swapping during video calls with acceptable latency (~80ms).
# Simulated deepfake preparation (educational only — no working code)
# This represents the attacker's capability, NOT instructions
DEEPFAKE MODEL SPECIFICATIONS (attacker infrastructure)
========================================================
Voice Cloning:
Base model: Open-source TTS with speaker adaptation
Training data: 6.8 hours clean audio
Fine-tuning: 12 hours on 4x NVIDIA A100 GPUs
Output quality: MOS 4.1/5.0 (natural speech quality score)
Real-time latency: ~120ms
Limitations: Struggles with laughter, coughing, emotional outbursts
Face Synthesis:
Base model: Open-source face-swap framework (modified)
Training data: 4.2 hours, ~380,000 face frames extracted
Resolution: 512x512 face region, upscaled to 1080p
Frame rate: 30 FPS with ~80ms latency
Limitations: Profile angles >45°, rapid head movement, hand-over-face
# Quality assessment by attackers (synthetic):
# "Voice passes phone test. Video passes casual Teams call.
# Avoid extended calls >15 min — quality degrades with fatigue.
# Keep lighting consistent. Use virtual background to mask edges."
Deepfake Technology Accessibility
Real-time deepfake capabilities that were previously limited to well-resourced threat actors are now accessible through open-source tools and cloud GPU rental. Organizations must assume that any individual with sufficient public media exposure can be convincingly impersonated in video calls.
Phase 3: Target Profiling and Pretext Development¶
ATT&CK Technique: T1598 (Phishing for Information)
PHANTOM FACE researches PII's recent business activities to construct a plausible pretext for the wire transfer. Through public SEC filings, press releases, and industry news, the attackers identify that PII has been publicly discussing potential acquisitions in the European market. This provides a credible cover story for an urgent confidential wire transfer.
# Simulated pretext development (educational only)
PRETEXT SCENARIO: "Confidential European acquisition"
Supporting intelligence (all from public sources):
- PII Q4 2025 earnings call: CEO mentions "exploring strategic
opportunities in European advanced manufacturing"
- Reuters article (Jan 2026): "Pinnacle Industries eyes European
expansion amid favorable EUR/USD exchange rates"
- SEC 8-K filing: PII increased revolving credit facility by $500M
(suggests M&A preparation)
Wire transfer parameters:
Amount: $4.2 million (below $5M single-approval threshold)
Recipient: "Kessler & Braun Escrow Services GmbH" (fictional)
Bank: Deutsche Bank Frankfurt (routing via correspondent bank)
Account: DE89 3704 0044 0532 0130 00 (synthetic IBAN)
Reference: "PII-ACQE-2026-CONFIDENTIAL"
Urgency: "Must be completed by 3:00 PM CT today — binding LOI deadline"
# Mule account chain (educational — how funds would be laundered):
# Stage 1: DE89... (Germany) → Stage 2: HK account → Stage 3: crypto
# Total layering time: ~4 hours before funds become unrecoverable
Phase 4: Attack Execution — The Deepfake Video Call¶
ATT&CK Technique: T1566 (Phishing), T1656 (Impersonation)
On March 15, 2026, at 8:47 AM CT, David Kowalski receives a Teams message from what appears to be CEO Margaret Chen's account, requesting an urgent video call. The attackers have created a lookalike Microsoft 365 account (m.chen@pinnacle-industries.example.com vs. the legitimate m.chen@pinnacleindustries.example.com — note the hyphen). The profile photo, display name, and status message match the real CEO's account.
# Simulated deepfake video call transcript (educational only)
[2026-03-15 08:47:12 CT] Teams message from "Margaret Chen" to David Kowalski:
"David, are you available for a quick video call? Something urgent
and highly confidential regarding the European expansion."
[2026-03-15 08:49:00 CT] Video call initiated
Caller: m.chen@pinnacle-industries.example.com (SPOOFED)
Video: ON (real-time deepfake — face synthesis active)
Audio: ON (real-time voice clone active)
Background: Virtual background matching CEO's known home office
[TRANSCRIPT — Deepfake "Margaret Chen"]:
"Good morning, David. Thank you for jumping on so quickly. I need
to discuss something extremely time-sensitive and confidential.
I'm asking you not to discuss this with anyone else on the team
until the deal is formally announced."
"We're finalizing the acquisition of Kessler Braun Manufacturing
in Stuttgart. The binding letter of intent expires at 9:00 PM
Frankfurt time — that's 3:00 PM your time. I need you to wire
$4.2 million to their escrow account to secure the deal."
"Robert [CFO] is aware but he's in transit from Singapore and
unreachable until tonight. I've authorized this personally.
Can you process this within the next two hours?"
[David Kowalski responds]:
"Of course, Margaret. I'll need the wire details."
[Deepfake "Margaret Chen"]:
"I'm sending you the escrow details via email right now. The
reference should be PII-ACQE-2026-CONFIDENTIAL. Please confirm
once the wire is submitted."
# Call duration: 7 minutes 42 seconds
# Deepfake quality indicators missed by target:
# - Slight lip sync delay (~80ms, within normal video call jitter)
# - CEO appeared slightly more formal than usual
# - No mention of specific previous conversations with David
# - Domain discrepancy (hyphen in email) not noticed
Phase 5: Wire Transfer and Initial Success¶
ATT&CK Technique: T1657 (Financial Theft)
Kowalski processes the wire transfer following what he believes to be a direct authorization from the CEO. The $4.2 million transaction is below the $5 million threshold that would require dual authorization under PII's treasury policy. The supporting email with wire instructions arrives from the spoofed domain and includes a convincing PDF with forged Kessler & Braun letterhead.
# Simulated wire transfer record (educational only)
WIRE TRANSFER — Pinnacle Industries International
==================================================
Date/Time: 2026-03-15 09:34:22 CT
Reference: PII-ACQE-2026-CONFIDENTIAL
Originator: Pinnacle Industries International
Account: [REDACTED — PII operating account]
Bank: JPMorgan Chase, Chicago
Beneficiary: Kessler & Braun Escrow Services GmbH (FICTITIOUS)
IBAN: DE89 3704 0044 0532 0130 00 (synthetic)
Bank: Deutsche Bank AG, Frankfurt
SWIFT: DEUTDEFF
Amount: USD 4,200,000.00
Purpose: Acquisition escrow deposit
Authorized by: David Kowalski, VP Treasury Operations
Authorization type: Single-party (below $5M threshold)
Status: SUBMITTED → PROCESSING → SETTLED (11:02 CT)
Phase 6: Detection¶
At 2:15 PM CT, CEO Margaret Chen returns from an investor lunch and checks her Teams messages. She sees Kowalski's confirmation message referencing an acquisition wire transfer she never authorized. Chen immediately contacts Kowalski, who realizes the video call was not with the real CEO.
# Simulated detection timeline (educational only)
[2026-03-15 14:15 CT] CEO Margaret Chen reviews Teams messages
→ Sees message from Kowalski: "Wire confirmed per our call this AM"
→ Chen has no record of any call or acquisition authorization
[2026-03-15 14:18 CT] Chen calls Kowalski directly (verified phone)
→ Kowalski: "We spoke on video this morning about the Kessler Braun deal"
→ Chen: "I had no call with you today. I was at an investor breakfast."
[2026-03-15 14:22 CT] INCIDENT DECLARED — Treasury fraud suspected
[2026-03-15 14:25 CT] IT Security notified — deepfake attack suspected
[2026-03-15 14:30 CT] Treasury initiates wire recall request with JPMorgan
→ Status: Funds already settled at correspondent bank
→ Recall attempt: INITIATED (success depends on speed and correspondent cooperation)
[2026-03-15 14:45 CT] Forensics team examines Teams call logs
→ Caller account: m.chen@pinnacle-industries.example.com
→ NOT legitimate domain (pinnacleindustries.example.com — no hyphen)
→ External tenant — Teams federation allowed the call
Phase 7: Incident Response¶
PII activates its Incident Response Plan with a focus on financial recovery, forensic evidence preservation, and policy remediation.
Immediate Actions (0-4 hours):
# Simulated incident response (educational only)
[14:30] WIRE RECALL initiated via SWIFT gpi
→ JPMorgan contacts Deutsche Bank Frankfurt
→ Funds status: Already forwarded to secondary account
→ Secondary bank contacted: Funds partially remaining ($1.8M frozen)
→ $2.4M already transferred to third-party accounts (likely unrecoverable)
[14:45] TEAMS FEDERATION restricted
→ External tenant calls blocked pending security review
→ Spoofed domain reported to Microsoft for takedown
→ All executive accounts: mandatory verified caller badge enabled
[15:00] FORENSIC PRESERVATION
→ Teams call recording retrieved (call was auto-recorded per policy)
→ Deepfake analysis initiated on recorded video
→ Email with wire instructions preserved (headers, attachments)
→ Network logs for spoofed domain DNS resolution captured
[15:30] EXECUTIVE NOTIFICATION
→ Board of Directors notified
→ General Counsel engaged (regulatory reporting assessment)
→ External IR firm engaged for deepfake forensics
Deepfake Forensic Analysis:
# Simulated deepfake detection analysis (educational only)
DEEPFAKE FORENSIC REPORT — PII-IR-2026-0315
=============================================
Analyst: External forensics firm
Sample: Teams call recording (7:42 duration, 1080p, 30fps)
VISUAL ANALYSIS:
Face consistency score: 0.87 (deepfake threshold: <0.92)
Blink rate: 14/min (normal: 15-20/min) — slightly low ← INDICATOR
Lip sync correlation: 0.91 (normal: >0.95) — slight delay ← INDICATOR
Facial boundary artifacts: Present at hairline (frames 4221-4340)
Skin texture consistency: Reduced pore detail in cheek region
Lighting response: Face lighting doesn't fully match background
AUDIO ANALYSIS:
Speaker similarity to reference: 0.94 (high quality clone)
Breathing pattern: Absent between sentences ← STRONG INDICATOR
Pitch variability: Reduced compared to reference recordings
Background noise: Artificially clean (no room ambiance)
Spectral analysis: Truncated frequency response above 14 kHz
VERDICT: CONFIRMED DEEPFAKE (confidence: 97.3%)
Video: AI-generated face synthesis (real-time face swap)
Audio: AI-generated voice clone (text-to-speech with speaker adaptation)
Policy and Control Updates:
Remediation Actions
- Mandatory out-of-band verification — All wire transfers over $100,000 require callback verification to a pre-registered phone number, regardless of apparent source
- Dual authorization — Threshold lowered from $5M to $500K for single-party approval
- Code word protocol — Rotating verbal code words for executive financial authorizations, changed weekly
- Teams federation lockdown — External tenant video calls require IT Security pre-approval
- Deepfake awareness training — Mandatory training for all finance, treasury, and executive staff
- AI detection tools — Real-time deepfake detection integrated into video conferencing platform
Detection Opportunities¶
Pre-Attack Detection¶
| Detection Point | Method | Indicator |
|---|---|---|
| Domain monitoring | Brand protection / typosquatting alerts | Registration of pinnacle-industries.example.com lookalike domain |
| OSINT monitoring | Executive media exposure tracking | Unusual scraping of CEO video content from corporate channels |
| Email gateway | Domain similarity detection (DMARC/DKIM) | Emails from lookalike domains failing authentication |
| Teams admin | External federation audit | Calls from unrecognized external tenants |
During-Attack Detection¶
# KQL — Detect external Teams calls to high-value targets (educational)
TeamsCallRecords
| where TimeGenerated > ago(24h)
| where CallDirection == "Incoming"
| where CallerTenantId != "YOUR_TENANT_ID"
| where CalleeUPN in ("cfo@pinnacleindustries.example.com",
"vp-treasury@pinnacleindustries.example.com")
| project TimeGenerated, CallerUPN, CallerTenantId, CallDuration, CallType
| sort by TimeGenerated desc
# SPL — Monitor wire transfers following video calls (educational)
index=treasury sourcetype=wire_transfer
| eval transfer_time=_time
| join type=inner caller_email
[search index=teams sourcetype=call_log call_type=video
| where caller_tenant!="internal"
| eval caller_email=caller_upn]
| where transfer_amount > 100000
| table transfer_time, amount, beneficiary, caller_email, call_duration
Deepfake Indicators for End Users¶
Red Flags During Video Calls
- Audio-visual desync — Lips don't perfectly match speech (>100ms lag)
- Unnatural blinking — Too fast, too slow, or too regular
- Facial boundary artifacts — Blurring or flickering at hairline, jaw, or ears
- Unusual lighting — Face illumination doesn't match room/background
- Missing micro-expressions — Face appears "too smooth" or emotionally flat
- No background noise — Room is impossibly quiet (AI audio is too clean)
- Avoids spontaneous interaction — Deflects unexpected questions or humor
- Urgency + secrecy — Classic social engineering pressure tactics
Lessons Learned¶
Key Takeaways
-
Video calls are no longer proof of identity — Real-time deepfake technology means that seeing someone on video is no longer sufficient verification. Out-of-band identity confirmation is mandatory for high-value actions.
-
Wire transfer thresholds must account for deepfake risk — Single-party authorization thresholds set before the deepfake era need urgent reassessment. Dual authorization and callback verification are minimum controls.
-
Executive media exposure creates attack surface — Every public video and audio recording of executives provides training data for deepfake models. Organizations should consider this when planning executive communications.
-
Technical controls must complement human awareness — Deepfake detection tools, domain monitoring, and federation controls provide defense-in-depth beyond human vigilance alone.
-
Speed of financial response is critical — Wire transfers can become unrecoverable within hours. Incident response plans must include pre-established relationships with banking partners for rapid recall procedures.
-
Lookalike domain detection is essential — Automated monitoring for typosquatting and lookalike domain registrations provides early warning of impersonation infrastructure.
MITRE ATT&CK Mapping¶
| Technique ID | Technique Name | Phase |
|---|---|---|
| T1598 | Phishing for Information | Reconnaissance |
| T1593 | Search Open Websites/Domains | Reconnaissance |
| T1585.001 | Establish Accounts: Social Media Accounts | Resource Development |
| T1566 | Phishing | Initial Access |
| T1656 | Impersonation | Initial Access |
| T1657 | Financial Theft | Impact |