AI Deepfake Voice Used in Failed Phishing Attack on LastPass Employee

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

Scammers used AI-generated deepfake audio to impersonate LastPass CEO Karim Toubba in a phishing attempt targeting a company employee via WhatsApp. The employee recognized the scam due to suspicious communication methods and reported it, preventing any harm. The incident highlights the growing threat of AI-enabled social engineering attacks.[AI generated]

Why's our monitor labelling this an incident or hazard?

The event involves the use of AI-generated deepfake audio to impersonate a CEO, which is a clear AI system involvement. The use of this AI system was malicious and aimed at causing harm (fraud), but the harm was averted because the employee did not fall for the scam. Therefore, this event is best classified as an AI Hazard, as it plausibly could lead to harm (fraud, financial loss) if successful, but no actual harm occurred in this case.[AI generated]
AI principles
Transparency & explainabilityPrivacy & data governanceRobustness & digital securitySafetyAccountability

Industries
Digital securityIT infrastructure and hosting

Affected stakeholders
WorkersBusiness

Harm types
Economic/PropertyReputationalPsychologicalHuman or fundamental rights

Severity
AI hazard

AI system task:
Content generation

In other databases

Articles about this incident or hazard

Thumbnail Image

Scammers Target LastPass Employee With CEO Audio Deepfake

2024-04-12
PC Magazine
Why's our monitor labelling this an incident or hazard?
The event involves the use of AI-generated deepfake audio to impersonate a CEO, which is a clear AI system involvement. The use of this AI system was malicious and aimed at causing harm (fraud), but the harm was averted because the employee did not fall for the scam. Therefore, this event is best classified as an AI Hazard, as it plausibly could lead to harm (fraud, financial loss) if successful, but no actual harm occurred in this case.
Thumbnail Image

Hackers Voice Cloned the CEO of LastPass for Attack

2024-04-13
Futurism
Why's our monitor labelling this an incident or hazard?
The event involves the use of an AI system (voice cloning) in a malicious attempt to deceive an employee, which is a misuse of AI technology. However, since the scam attempt was detected and did not result in any realized harm such as data breach, financial loss, or other damages, it constitutes a potential threat rather than an actual incident. Therefore, it qualifies as an AI Hazard because the AI system's use could plausibly lead to harm if successful, but no harm occurred in this case.
Thumbnail Image

Attempted voice phishing against LastPass thwarted

2024-04-12
SC Media
Why's our monitor labelling this an incident or hazard?
The use of AI-generated deepfake audio to impersonate a CEO for phishing is an AI system's use that could plausibly lead to harm, such as unauthorized access to sensitive systems or data breaches. Although no harm occurred in this case due to the employee's vigilance, the event demonstrates a credible AI Hazard. The article also references similar ongoing attacks, reinforcing the plausible risk. Since no actual harm occurred, this is classified as an AI Hazard rather than an AI Incident.
Thumbnail Image

LastPass thwarts attempt to deceive employee with deepfake audio

2024-04-12
SC Media
Why's our monitor labelling this an incident or hazard?
The event involves the use of an AI system (deepfake audio generation) in a malicious attempt to deceive an employee. Although no harm occurred because the employee detected the scam and reported it, the incident demonstrates a plausible risk of harm from AI misuse. Therefore, it qualifies as an AI Hazard, as the AI system's use could plausibly lead to an AI Incident if such attacks succeed in the future. The article focuses on raising awareness and educating about this emerging threat rather than reporting actual harm.
Thumbnail Image

LastPass Reports Voice Phishing Attempt on Employee Using Audio Deepfake of Company CEO - CPO Magazine

2024-04-16
CPO Magazine
Why's our monitor labelling this an incident or hazard?
The event involves the use of an AI system (audio deepfake generation) in a malicious voice phishing attempt. Although no harm was realized because the employee recognized the scam, the AI system's involvement in the attack could plausibly lead to harm such as financial theft or security breaches if successful. The article also discusses the increasing sophistication and frequency of such AI-enabled attacks, reinforcing the credible risk. Since the harm is potential and not realized, this is best classified as an AI Hazard rather than an AI Incident. It is not Complementary Information because the main focus is on the attack attempt itself, not on responses or broader ecosystem updates. It is not Unrelated because AI is central to the event.
Thumbnail Image

Deepfake audio of CEO used in attempt to trick employee

2024-04-15
HR Grapevine
Why's our monitor labelling this an incident or hazard?
The event involves the use of an AI system (generative AI for deepfake audio) in a malicious attempt to deceive an employee, which is a use of AI that could plausibly lead to harm such as fraud, data breaches, or financial loss. Since no actual harm occurred in this case, but the tactic represents a credible and emerging threat, this qualifies as an AI Hazard rather than an AI Incident. The article focuses on raising awareness of this tactic and the potential risks it poses, consistent with the definition of an AI Hazard.