Hacker Deepfakes Employee's Voice in Phone Call to Breach IT Company
A hacker used AI to deepfake an employee’s voice and break into an IT company.
The breach, which ensnared 27 cloud customers, occurred last month at Retool, a company that helps clients build business software.
The hacker kicked off the intrusion by sending several employees at Retool SMS-based text messages that claimed to come from a member of Retool’s IT team who was reaching out to resolve a payroll issue preventing employees from receiving healthcare coverage. Most Retool employees who received the phishing message refrained from responding, except for one.
The unsuspecting employee clicked a URL in the message, which forwarded them to a fake internet portal to log in. After logging into the portal, which included a multi-factor authentication form, the hacker called the employee while using an AI-powered deepfake.
“The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice,” Retool said in the report. “The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company. Throughout the conversation, the employee grew more and more suspicious, but unfortunately did provide the attacker one additional multi-factor authentication (MFA) code.”
The incident suggests the mysterious attacker may have already infiltrated Retool to some extent before calling the employee. Once the multi-factor code was given up, the attacker added their own device to the employee’s account and pivoted toward accessing their GSuite account.
Retool says the GSuite access was especially devastating since Google’s Authenticator app recently incorporated a cloud syncing function. This means your multi-factor authenticator codes can be viewed on more than one
Read more on pcmag.com
