LastPass, a password management platform, recently disclosed an attempted voice phishing attack targeting one of their employees using sophisticated deepfake audio technology to impersonate the company’s CEO, Karim Toubba. The threat actor attempted to contact the employee via WhatsApp, leaving a series of calls, text messages, and at least one (1) voicemail that featured audio deepfake impersonation, which is an uncommon business channel used by the company and is originally why the employee identified the activity as suspicious. On top of the attempted communication outside of typical business channels, the messages appeared to include other red flags such as forced urgency that are common in social engineering attempts. This led the employee to ignore the messages and report it to the company’s internal security team. LastPass remained unaffected by the threat actor’s attempted attack but decided to publicize the incident to highlight the existence of AI-generated deepfakes in the wild and the potential for threat actors to use this technology for executive impersonation fraud campaigns, as it had been used against them. This case emphasizes the increasing sophistication of cyberattacks, with deepfake technology making it challenging to authenticate identities remotely. This incident is part of a broader trend, with recent alerts from the U.S. Department of Health and Human Services (HHS) on similar social engineering tactics and AI voice cloning tools that could be used to target IT help desks, along with a warning from the FBI about the potential widespread use of deepfakes in cyber and foreign influence operations. Europol has also released warnings, predicting that deepfakes could become commonplace in cybercriminal activities such as CEO fraud, evidence tampering, and non-consensual pornography creation. The rise of deepfake technology necessitates heightened awareness and enhanced security measures, including strict verification processes for sensitive requests, training for staff to recognize social engineering, and the revalidation of users with access to critical systems. CTIX analysts will continue monitoring evolving cyber threats in order for organizations to remain vigilant and implement proactive security measures.