The Same Content That Builds Your Brand Is Building Attackers' Deepfakes

Social engineering is taking a new shape. Between the volume of Open-Source Intelligence (OSINT) available on any given employee and the maturity of AI-assisted media generation, building convincing impersonation has never been easier. While attackers are experimenting with different campaigns, some of the most prevalent headlines gaining traction include attacks around:

• Executive impersonation - fake leadership profiles used to defraud employees and partners

• Workforce infiltration - synthetic recruiter or candidate profiles used to plant hires

• Brand impersonation - spoofed company pages used to defraud customers

These attack campaigns are today's central headlines, but the techniques behind them aren't campaign-specific. Many were executed with a combination of fake accounts on LinkedIn and other platforms, messages through text, chat, or email, and deepfake voice or video. While techniques vary among campaigns, the common thread is none of these require a system breach. It is through exploiting human trust that information gets disclosed and a breach can happen.

Two things make this possible. First, these campaigns are good at mimicking normal, everyday workflows, so a fraudulent request looks and feels legitimate. Second, remote and distributed work has changed the way we interact. Since we no longer have face-to-face interactions to sanity-check a request in person, we now solely rely on digital signals. These include the tone of voice, a message’s context, or a familiar looking profile to determine whether we act. AI has further complicated this authentication because deepfakes require only a few seconds of sampled audio or a single job posting to create a realistic synthetic conversation or profile.

As deepfakes get easier to produce, this becomes a standing threat to the enterprise, one that requires a new approach to defend and protect your organization.

Deepfake Defense Has to Work at Every Stage, Not Just One

Don’t wait until an impersonation reaches your enterprise. There are ways to get ahead and even catch them if they slip through.

Think about it this way. If the information never existed online, attackers wouldn’t have the ingredients to build the deepfake in the first place. Take the attack campaigns mentioned above as examples:

• Executive impersonation: Attackers assemble real biographical details from data brokers and people-search sites, then layer in the professional texture from SEC filings, earnings calls, conference recordings, etc.

• Workforce infiltration: Real professional details (skills, work history, code contributions) are scraped from LinkedIn, GitHub, and similar platforms. That, combined with the job posting itself, lets attackers tailor a candidate who matches the exact requirements sought for the role calls.

• Brand impersonation: Since brand assets are public by design, attackers clone the company’s website, logos, and social presence to stand up a convincing fake.

Some of this information is difficult to remove, as it sits with employees or is simply public knowledge. However, knowing it is out there and how it can be leveraged is a good starting point.

While removing non-essential information makes the attacker’s job harder, it doesn’t make it impossible. That’s why the next layer is active prevention. With active prevention, there are different angles to evaluate. There are impersonations across cloned profiles, spoofed domains, or sites that could be found at any point in time. And, there are voice and video impersonations that require monitoring the calls in real-time to detect synthetic activity.

No Single Tool Stops a Deepfake. Here’s the Tech Stack Needed  

So, what does this look like from a technical perspective? These three pillars can help protect an organization both proactively and during a social engineering attack.

Reduce

This pillar provides the earliest possible intervention. Since convincing impersonation relies on biographical details, organizational context, and brand assets, removing unnecessary OSINT on a continuous basis lowers the quality of the impersonation.

This breaks into two approaches: personal PII data about employees, and sensitive organizational information. From a personal/PII standpoint, solutions monitor and remove employee public records such as addresses, phone numbers, property records, and family member information. On the organizational side, a distinct set of solutions target surfaced credentials, stolen session cookies, passwords, and financial data. Personal OSINT is best for removing details about an individual that could lead to his or her impersonation, while organizational OSINT removes insights into internal organization processes and systems that could be used to gain credibility. When deciding what information to monitor, keep in mind some of this information is personal to the individual and may not be controlled by the organization.

Detect

While Reduce is for proactive measures before an impersonation happens, Detect finds the impersonation in real time. As deception gets easier with AI, the volume and quality of creations require a review of detection mechanisms. It’s not enough to simply detect fake profiles or pages online, now it’s also about detecting impersonations live on a meeting or call. Analyzing these approaches together creates a strong detection strategy.

While not necessarily an emerging use case, the practice of digital risk protection (DRPS) remains essential for finding and dismantling deceptions from fake profiles, cloned brand pages, lookalike domains, and fraudulent applications. Some solutions go beyond this detection to create additional disruption or decoys, and even provide takedown of these sites. However, with deepfake text, video, and audio, there is not always a public asset for DRPS tools to find. Many deepfakes happen in real-time over a conversation. To solve this, there are emerging deepfake detection solutions focused on acoustic analysis, behavioral biometrics, and provenance checks to flag a manipulation during the interaction.

Together, these approaches help detect fraudulent assets online, as well as deceptions happening in real-time. As attackers’ synthetic models and approaches continuously evolve, it’s likely detection solutions will do so too, adding new features and capabilities to keep enterprises safe.

Prove

While Reduce is before an impersonation happens and Detect catches it in the moment, Prove answers the question of “is this person who they say they are and can you trust the environment they are transacting in?” While identity verification used to be a Know Your Customer (KYC) checkbox, it is quickly becoming an enterprise defense against deepfake impersonations. Verification is important as a candidate is interviewing and onboarding, supporting employee day-to-day access, and help desk support moments for account recovery, MFA resets, etc.

Scanning a government ID and capturing a live selfie were classic verification methods. Now, solutions are increasingly moving towards device-level attestation and biometric matching to better defend against AI-generated faces. However, the credential layer alone can’t tell you whether the session running has been compromised. To complement this, a new space is being created that looks at the session itself, like the device, network, and communication channels rather than the face. It pairs this compromised environmental analysis with role-specific questions pulled from actual work data to further verify with confidence this is the true person.

Together, the credential and environment layers give organizations a way to prove an employee is who they say they are.

Deepfakes Aren’t Going Away. Your Defense Needs to Catch Up  

While it was once sufficient to prove an identity once and trust that interaction throughout, remote-first work and advancing deepfake technology are challenging this model. Together, these create an environment where impersonation thrives. Remote work requires us to make the judgement call on virtual signals, and deepfake technologies provide strong impersonations that make you seriously question whether you are interacting with actual company resources and people.

So, how do you move forward?

With such a dynamic challenge comes a dynamic answer. Thinking about the attack campaigns described throughout (executive impersonation, workforce infiltration, and brand impersonation), each of these has a central theme - they are cross-functional, from human resources to marketing to IT, and so on. This makes the attack easier to implement, as it touches so many people, and makes it more difficult to detect. Finally, it begs the question who is responsible within the organization for creating and managing the deepfake detection and response strategy. While these are common challenges felt throughout the enterprise, a good place to start is by understanding what threats your organization is currently experiencing. From there, you can bring together the right people and decide which solutions can help mitigate the risks. Reduce will help shrink the attack surface before an attempt happens. Detect catches the attempt in motion. Prove will close the gap by validating someone is who they say they are.

While this framework will help manage your current challenges, it’s important to recognize this is just the starting point. As these attack campaigns continue taking headlines, it is likely attackers will find the next entry point for impersonations. While you are developing your detection and prevention strategy, be sure the Innovation team is keeping an eye on what’s coming and will be there to support you in your decisions.

If you’re curious to learn more or want to stay on top of the latest developments in Innovation, feel free to reach out to us at innovation@trace3.com.