How to Verify a CEO's Identity During an Urgent Request

In April 2024, attackers attempted to compromise LastPass by using audio deepfakes to impersonate CEO Karim Toubba. The attackers utilized a combination of WhatsApp calls, text messages, and voicemails to contact an employee, aiming to leverage the authority of the CEO to bypass standard security protocols.

What happened

The attackers initiated contact outside of normal communication channels, a classic hallmark of social engineering. By utilizing audio deepfakes that mimicked the CEO's voice and accent, they attempted to create a sense of manufactured urgency, pressuring the employee to act quickly on a request. This method relies on the psychological impact of perceived executive authority rather than the flawless technical quality of the synthetic media itself.

Ultimately, the attack failed because the employee recognized the circumstantial red flags. The request arrived through an unconventional channel and lacked the typical procedural context expected for such communications. Because the employee was trained to prioritize verification over the perceived identity of the caller, they reported the contact rather than complying with the fraudulent instructions. The LastPass incident serves as a reminder that attackers use publicly available information—such as audio from earnings calls, podcasts, and conference talks—to train voice cloning models. When these models are paired with high-pressure scenarios, they are designed to bypass human judgment by exploiting our natural tendency to trust familiar voices and faces. The attempted attack highlights why organizations must shift from relying on human detection to implementing procedural safeguards, such as requiring secondary verification through trusted, pre-established communication channels for all sensitive or high-risk requests.