How Attackers Are Adding AI Voice Cloning to Microsoft Teams Attacks
Summary: Attackers are using Microsoft Teams' cross-tenant collaboration feature, enabled by default in most enterprise deployments, to pose as IT helpdesk staff and persuade employees to open Quick Assist and approve a remote session. A newer variant adds AI-generated voice cloning, built from 30 seconds to several minutes of clean audio found in webinars, conference talks, and earnings calls, with a follow-up phone call impersonating an IT director, manager, or executive.
Why it matters: A 2024 incident at engineering firm Arup saw an employee authorize a $25 million transfer after a video call using deepfake audio and video of colleagues, and the 10 to 15 minutes between initial access and lateral movement generate no alert because the activity looks like legitimate IT work.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026