LastPass employee voice deepfake — Apr 2024

A LastPass employee recently thwarted a targeted phishing attempt that utilized AI-generated voice cloning to impersonate the company's CEO, Karim Toubba. The incident serves as a stark reminder of the growing accessibility of deepfake technology for corporate impersonation fraud.

What happened

The attack began when a scammer, who had somehow obtained the employee's contact information, initiated contact via WhatsApp. The fraudster set up an account posing as CEO Karim Toubba and proceeded to send a series of missed audio calls and at least one voice message. This message utilized AI technology to replicate the CEO's voice in an attempt to gain the employee's trust.

The phishing attempt ultimately failed because the employee recognized several red flags. The messages were sent through WhatsApp, which is outside of the company's normal business communication channels. Furthermore, the scammer employed "forced urgency" in their messaging, a common manipulation tactic that alerted the employee to the fraudulent nature of the request. The employee did not fall for the ruse and promptly reported the incident to the LastPass security team. LastPass confirmed that the company experienced no impact from the attempt and shared the details publicly to raise awareness about the increasing use of deepfakes in executive impersonation campaigns.