AI-Powered Voice Cloning Raises Vishing Risks

AI-powered voice cloning is driving up vishing risks, with researchers noting that AI-generated clones can be created from as little as five minutes of recorded audio and used in real-time conversations to extract sensitive information. According to NCC Group, voice impersonation now enables more refined social engineering attacks that could target enterprises, their employees, and individuals.

The researchers have demonstrated real-time voice processing and cloning, and report that the framework could be operated by attackers with average technical understanding and modest resources. Incidents cited include a Cisco data breach disclosed in August where a vishing attack targeted a Cisco representative, a June impersonation of IT staff at Salesforce, and a May move by the 3AM ransomware group to combine email bombing with vishing.

To mitigate the threat, the researchers recommend multi-factor authentication, staff training to verify unusual requests, use of code words or secondary verification for sensitive actions, and limiting public voice exposure for executives.