# AI-Enabled Social Engineering and Synthetic Media (Deepfakes) Undermining Identity Verification

> Recorded Future's Insikt Group reports escalating AI-enabled social engineering: AI-enhanced phishing (malicious LLMs, EvilTokens device-code PhaaS, AI site builders) is largely countered by existing defenses, but synthetic media (voice cloning, live video deepfakes, biometric injection) erodes the audiovisual and biometric signals organizations use to verify identity. Documented losses include Arup (~$25M, Feb 2024) and a Singapore deepfake Zoom fraud (~SGD 4.9M, May 2026).

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2774
- **ID:** TL-2026-2774
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Insikt Group's 'Social Engineering in the Age of Synthetic Media' distinguishes two problems. First, AI-enhanced phishing: generative AI produces personalized lures, fraudulent login pages and automated follow-ups, and is packaged in underground offerings. The report names malicious LLMs (WormGPT, WormGPT4, EscapeGPT, FraudGPT, WolfGPT, DarkGPT, BlackhatGPT, KawaiiGPT, Nytheon, Xanthorox, GhostGPT, SheByte) and the EvilTokens phishing-as-a-service kit (emerged April 2026 per the report), which combines AI-generated lures, account validation, customizable infrastructure and automated creation of fresh device sign-in codes. The report also notes abuse of legitimate AI tooling, such as the Lovable AI website builder used to stand up large numbers of sites impersonating Microsoft, UPS and HR/financial platforms (August 2025), and open-weight models (GLM-5.2, Kimi, DeepSeek, Qwen, HUIHUI-AI reportedly used by the Gentlemen ransomware group). Insikt's assessment is that most of this can still be handled with existing defenses: email/web filtering, phishing-resistant MFA, monitoring for anomalous sign-ins, new inbox rules and unexpected permissions, and session revocation.

Second, synthetic media is the exception. Voice cloning of executives and officials, live video-call impersonation and falsified identity documents weaken the trust signals people and identity-verification vendors depend on. Facial biometric injection inserts AI-generated faces into video streams through virtual cameras or modified software, and screen-replay videos of synthetic blinking are used to pass liveness checks. Group-IB-recorded data cited by the report shows 8,065 biometric bypass attempts at an unnamed financial institution between January and August 2025; Telegram groups sell deepfake bypass tools aimed at platforms such as Binance, BBVA and Revolut. Human and automated detection is unreliable: a 2024 study put human identification accuracy of synthetic image/audio/video at 51.2%, and a May 2026 study found deepfake detectors only slightly better than chance.

Case studies: in February 2024 an Arup employee joined a video call with deepfaked CFO and colleagues and made 15 transfers to five Hong Kong accounts (~HK$200M / US$25M); no Arup systems were breached. In May 2026 a Singapore professional was contacted on WhatsApp by someone posing as the Secretary to the Cabinet, signed an NDA, joined a fabricated Zoom meeting with deepfaked senior officials, and transferred at least SGD 4.9M after a follow-up from a fake lawyer; Singapore Police cited poor lip-sync, distorted backgrounds, obscured Zoom logos and audio routed through a single account as tell-tale signs. The FBI has warned since 2023 (updated 19 Dec 2025) of smishing and AI voice-clone vishing impersonating senior US officials, moving victims to encrypted messaging apps.

Supporting technical reporting on EvilTokens (Microsoft, 6 Apr 2026; Abnormal, 3 Apr 2026; Sekoia, March 2026) shows the device-code flow being abused so victims complete real MFA on Microsoft infrastructure while the attacker captures OAuth tokens, then registers devices for Primary Refresh Tokens, creates inbox rules, performs Microsoft Graph reconnaissance and mines mailboxes for payment threads. The source report itself lists no IOCs and no nation-state attribution; the IOCs below come from the cited vendor reports.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1583.006 Acquire Infrastructure: Web Services
- T1583.001 Acquire Infrastructure: Domains
- T1566.002 Phishing: Spearphishing Link
- T1566.004 Phishing: Spearphishing Voice
- T1078.004 Valid Accounts: Cloud Accounts
- T1204.001 User Execution: Malicious Link
- T1528 Steal Application Access Token
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1684.001 Impersonation
- T1098.005 Account Manipulation: Device Registration
- T1087.004 Account Discovery: Cloud Account
- T1114.003 Email Collection: Email Forwarding Rule
- T1657 Financial Theft

## Sources

- [Social Engineering in the Age of Synthetic Media (Recorded Future Insikt Group)](https://www.recordedfuture.com/blog/ai-social-engineering)
- [AI-enabled device code phishing campaign (Microsoft Defender Security Research)](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [EvilTokens: Turning OAuth Device Codes into Full-Scale BEC Operations (Abnormal AI)](https://abnormal.ai/blog/eviltokens-oauth-device-codes-bec-operations)
- [Cybercriminals abuse AI website creation app for phishing (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing)
- [FBI IC3 PSA: Impersonation of senior US officials](https://www.ic3.gov/PSA/2025/PSA251219)
- [Singapore Police Force advisory on scams impersonating senior government officials](https://www.police.gov.sg/Media-Hub/News/2026/05/20260514_advisory_on_scams_involving_impersonation_of_snr_govt_officials_incl_secy_cabinet)
- [Deepfake Zoom scam impersonates Singapore PM (Sumsub)](https://sumsub.com/media/news/deepfake-zoom-scam-impersonating-singapore-pm/)
- [UK-Based Arup Loses $25 Million in Deepfake Video Conference Scam (FinTelegram)](https://fintelegram.com/arup-loses-25-million-in-deepfake-video-conference-scam/)
- [The Dilemma of AI: Malicious LLMs (Unit 42)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/)
- [Threat actor usage of AI tools (Google Cloud Threat Intelligence)](https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools)
- [WormGPT: New AI tool allows cybercriminals (The Hacker News)](https://thehackernews.com/2023/07/wormgpt-new-ai-tool-allows.html)
- [Cyberscammers bypassing bank verification via Telegram (MIT Technology Review)](https://www.technologyreview.com/2026/04/15/1135898/cyberscammers-bypassing-bank-telegram/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2774